summaryrefslogtreecommitdiff
path: root/testing
diff options
context:
space:
mode:
authorYves-Alexis Perez <corsac@debian.org>2013-02-07 13:27:27 +0100
committerYves-Alexis Perez <corsac@debian.org>2013-02-07 13:27:27 +0100
commit7585facf05d927eb6df3929ce09ed5e60d905437 (patch)
treee4d14b4dc180db20356b6b01ce0112f3a2d7897e /testing
parentc1343b3278cdf99533b7902744d15969f9d6fdc1 (diff)
downloadvyos-strongswan-7585facf05d927eb6df3929ce09ed5e60d905437.tar.gz
vyos-strongswan-7585facf05d927eb6df3929ce09ed5e60d905437.zip
Imported Upstream version 5.0.2
Diffstat (limited to 'testing')
-rw-r--r--testing/INSTALL145
-rw-r--r--testing/Makefile.am13
-rw-r--r--testing/Makefile.in45
-rw-r--r--testing/README170
-rw-r--r--testing/config/kernel/config-3.51817
-rw-r--r--testing/config/kernel/config-3.61830
-rw-r--r--testing/config/kvm/alice.xml70
-rw-r--r--testing/config/kvm/bob.xml64
-rw-r--r--testing/config/kvm/carol.xml64
-rw-r--r--testing/config/kvm/dave.xml64
-rw-r--r--testing/config/kvm/moon.xml70
-rw-r--r--testing/config/kvm/sun.xml70
-rw-r--r--testing/config/kvm/venus.xml64
-rw-r--r--testing/config/kvm/vnet1.xml11
-rw-r--r--testing/config/kvm/vnet2.xml11
-rw-r--r--testing/config/kvm/vnet3.xml11
-rw-r--r--testing/config/kvm/winnetou.xml64
-rwxr-xr-xtesting/do-tests (renamed from testing/do-tests.in)188
-rw-r--r--testing/hosts/alice/etc/conf.d/hostname1
-rw-r--r--testing/hosts/alice/etc/conf.d/net12
-rw-r--r--testing/hosts/alice/etc/freeradius/clients.conf4
-rw-r--r--testing/hosts/alice/etc/freeradius/dictionary32
-rw-r--r--testing/hosts/alice/etc/freeradius/radiusd.conf (renamed from testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/radiusd.conf)18
-rw-r--r--testing/hosts/alice/etc/hostname1
-rwxr-xr-xtesting/hosts/alice/etc/init.d/iptables74
-rwxr-xr-xtesting/hosts/alice/etc/init.d/net.eth01124
-rwxr-xr-xtesting/hosts/alice/etc/init.d/net.eth11124
-rwxr-xr-xtesting/hosts/alice/etc/init.d/radiusd64
-rw-r--r--[-rwxr-xr-x]testing/hosts/alice/etc/ipsec.conf2
-rw-r--r--testing/hosts/alice/etc/network/interfaces20
-rwxr-xr-xtesting/hosts/alice/etc/runlevels/default/net.eth01124
-rw-r--r--testing/hosts/bob/etc/conf.d/hostname1
-rw-r--r--testing/hosts/bob/etc/conf.d/net10
-rw-r--r--testing/hosts/bob/etc/hostname1
-rwxr-xr-xtesting/hosts/bob/etc/init.d/iptables74
-rwxr-xr-xtesting/hosts/bob/etc/init.d/net.eth01124
-rw-r--r--[-rwxr-xr-x]testing/hosts/bob/etc/ipsec.conf0
-rw-r--r--testing/hosts/bob/etc/network/interfaces12
-rwxr-xr-xtesting/hosts/bob/etc/runlevels/default/net.eth01124
-rw-r--r--testing/hosts/carol/etc/conf.d/hostname1
-rw-r--r--testing/hosts/carol/etc/conf.d/net10
-rw-r--r--testing/hosts/carol/etc/hostname1
-rwxr-xr-xtesting/hosts/carol/etc/init.d/iptables77
-rwxr-xr-xtesting/hosts/carol/etc/init.d/net.eth01124
-rw-r--r--[-rwxr-xr-x]testing/hosts/carol/etc/ipsec.conf4
-rw-r--r--testing/hosts/carol/etc/network/interfaces12
-rwxr-xr-xtesting/hosts/carol/etc/runlevels/default/net.eth01124
-rw-r--r--testing/hosts/dave/etc/conf.d/hostname1
-rw-r--r--testing/hosts/dave/etc/conf.d/net10
-rw-r--r--testing/hosts/dave/etc/hostname1
-rwxr-xr-xtesting/hosts/dave/etc/init.d/iptables77
-rwxr-xr-xtesting/hosts/dave/etc/init.d/net.eth01124
-rw-r--r--[-rwxr-xr-x]testing/hosts/dave/etc/ipsec.conf4
-rw-r--r--testing/hosts/dave/etc/network/interfaces12
-rwxr-xr-xtesting/hosts/dave/etc/runlevels/default/net.eth01124
-rw-r--r--testing/hosts/default/etc/default/slapd45
-rw-r--r--testing/hosts/default/etc/fstab1
-rw-r--r--testing/hosts/default/etc/ip6tables.flush15
-rw-r--r--testing/hosts/default/etc/ip6tables.rules39
-rw-r--r--testing/hosts/default/etc/iptables.drop12
-rw-r--r--testing/hosts/default/etc/iptables.flush21
-rw-r--r--testing/hosts/default/etc/iptables.rules28
-rw-r--r--testing/hosts/default/etc/profile.d/coredumps.sh5
-rw-r--r--testing/hosts/default/etc/rsyslog.conf125
-rw-r--r--testing/hosts/default/etc/security/limits.conf58
-rw-r--r--testing/hosts/default/etc/ssh/sshd_config13
-rw-r--r--testing/hosts/default/etc/sysctl.conf62
-rw-r--r--testing/hosts/default/root/.ssh/config3
-rwxr-xr-xtesting/hosts/default/usr/local/bin/expect-connection27
-rw-r--r--testing/hosts/moon/etc/conf.d/hostname1
-rw-r--r--testing/hosts/moon/etc/conf.d/net12
-rw-r--r--testing/hosts/moon/etc/hostname1
-rwxr-xr-xtesting/hosts/moon/etc/init.d/iptables80
-rwxr-xr-xtesting/hosts/moon/etc/init.d/net.eth01124
-rwxr-xr-xtesting/hosts/moon/etc/init.d/net.eth11124
-rw-r--r--[-rwxr-xr-x]testing/hosts/moon/etc/ipsec.conf8
-rw-r--r--testing/hosts/moon/etc/network/interfaces21
-rwxr-xr-xtesting/hosts/moon/etc/rc.local20
-rwxr-xr-xtesting/hosts/moon/etc/runlevels/default/net.eth01124
-rwxr-xr-xtesting/hosts/moon/etc/runlevels/default/net.eth11124
-rw-r--r--testing/hosts/ssh_host_rsa_key.pub1
-rw-r--r--testing/hosts/sun/etc/conf.d/hostname1
-rw-r--r--testing/hosts/sun/etc/conf.d/net14
-rw-r--r--testing/hosts/sun/etc/hostname1
-rwxr-xr-xtesting/hosts/sun/etc/init.d/iptables80
-rwxr-xr-xtesting/hosts/sun/etc/init.d/net.eth01124
-rwxr-xr-xtesting/hosts/sun/etc/init.d/net.eth11124
-rw-r--r--[-rwxr-xr-x]testing/hosts/sun/etc/ipsec.conf6
-rw-r--r--testing/hosts/sun/etc/network/interfaces21
-rwxr-xr-xtesting/hosts/sun/etc/runlevels/default/net.eth01124
-rwxr-xr-xtesting/hosts/sun/etc/runlevels/default/net.eth11124
-rw-r--r--testing/hosts/venus/etc/conf.d/hostname1
-rw-r--r--testing/hosts/venus/etc/conf.d/net10
-rw-r--r--testing/hosts/venus/etc/hostname1
-rwxr-xr-xtesting/hosts/venus/etc/init.d/iptables74
-rwxr-xr-xtesting/hosts/venus/etc/init.d/net.eth01124
-rw-r--r--[-rwxr-xr-x]testing/hosts/venus/etc/ipsec.conf2
-rw-r--r--testing/hosts/venus/etc/network/interfaces12
-rwxr-xr-xtesting/hosts/venus/etc/runlevels/default/net.eth01124
-rw-r--r--testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text1
-rw-r--r--testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt22
-rw-r--r--testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt24
-rw-r--r--testing/hosts/winnetou/etc/apache2/conf/ssl/server.key27
-rw-r--r--testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf61
-rw-r--r--testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost (renamed from testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf)2
-rw-r--r--testing/hosts/winnetou/etc/conf.d/hostname1
-rw-r--r--testing/hosts/winnetou/etc/conf.d/net10
-rw-r--r--testing/hosts/winnetou/etc/conf.d/slapd8
-rwxr-xr-xtesting/hosts/winnetou/etc/init.d/apache2121
-rwxr-xr-xtesting/hosts/winnetou/etc/init.d/net.eth01124
-rwxr-xr-xtesting/hosts/winnetou/etc/init.d/slapd25
-rw-r--r--testing/hosts/winnetou/etc/ldap/ldif.txt (renamed from testing/hosts/winnetou/etc/openldap/ldif.txt)3
-rw-r--r--testing/hosts/winnetou/etc/ldap/slapd.conf23
-rw-r--r--testing/hosts/winnetou/etc/network/interfaces12
-rw-r--r--testing/hosts/winnetou/etc/openldap/slapd.conf68
-rwxr-xr-xtesting/hosts/winnetou/etc/openssl/generate-crl18
-rw-r--r--testing/hosts/winnetou/etc/openssl/index.html4
-rwxr-xr-xtesting/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi8
-rwxr-xr-xtesting/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi8
-rwxr-xr-xtesting/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi8
-rwxr-xr-xtesting/hosts/winnetou/etc/runlevels/default/apache2121
-rwxr-xr-xtesting/hosts/winnetou/etc/runlevels/default/net.eth01124
-rwxr-xr-xtesting/make-testing84
-rwxr-xr-xtesting/scripts/build-baseimage79
-rwxr-xr-xtesting/scripts/build-guestimages65
-rwxr-xr-xtesting/scripts/build-guestkernel49
-rwxr-xr-xtesting/scripts/build-hostconfig122
-rwxr-xr-xtesting/scripts/build-rootimage67
-rwxr-xr-xtesting/scripts/build-sshkeys86
-rwxr-xr-xtesting/scripts/build-umlhostfs78
-rwxr-xr-xtesting/scripts/build-umlkernel130
-rwxr-xr-xtesting/scripts/build-umlrootfs451
-rwxr-xr-xtesting/scripts/function.sh208
-rwxr-xr-xtesting/scripts/gstart-umls126
-rwxr-xr-xtesting/scripts/install-shared38
-rwxr-xr-xtesting/scripts/kstart-umls126
-rwxr-xr-xtesting/scripts/load-testconfig17
-rw-r--r--testing/scripts/recipes/001_libtnc.mk31
-rw-r--r--testing/scripts/recipes/002_tnc-fhh.mk28
-rw-r--r--testing/scripts/recipes/003_freeradius.mk44
-rw-r--r--testing/scripts/recipes/004_iptables.mk37
-rw-r--r--testing/scripts/recipes/005_strongswan.mk87
-rw-r--r--testing/scripts/recipes/patches/freeradius-avp-size18
-rw-r--r--testing/scripts/recipes/patches/freeradius-eap-sim-identity30
-rw-r--r--testing/scripts/recipes/patches/freeradius-tnc-fhh6687
-rw-r--r--testing/scripts/recipes/patches/iptables-xfrm-hooks61
-rwxr-xr-xtesting/scripts/restore-defaults23
-rwxr-xr-xtesting/scripts/shutdown-umls38
-rwxr-xr-xtesting/scripts/start-bridges64
-rwxr-xr-xtesting/scripts/start-umls117
-rwxr-xr-xtesting/scripts/stop-bridges49
-rwxr-xr-xtesting/scripts/xstart-umls126
-rw-r--r--testing/ssh_config3
-rwxr-xr-xtesting/start-testing129
-rwxr-xr-xtesting/stop-testing70
-rw-r--r--[-rwxr-xr-x]testing/testing.conf220
-rw-r--r--testing/tests/af-alg/alg-camellia/evaltest.dat2
-rw-r--r--testing/tests/af-alg/alg-camellia/posttest.dat4
-rw-r--r--testing/tests/af-alg/alg-camellia/pretest.dat4
-rw-r--r--testing/tests/af-alg/alg-camellia/test.conf10
-rw-r--r--testing/tests/af-alg/rw-cert/evaltest.dat4
-rw-r--r--testing/tests/af-alg/rw-cert/posttest.dat6
-rw-r--r--testing/tests/af-alg/rw-cert/pretest.dat6
-rw-r--r--testing/tests/af-alg/rw-cert/test.conf10
-rw-r--r--testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat2
-rw-r--r--testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat1
-rw-r--r--testing/tests/gcrypt-ikev1/alg-serpent/test.conf10
-rw-r--r--testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat2
-rw-r--r--testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat1
-rw-r--r--testing/tests/gcrypt-ikev1/alg-twofish/test.conf10
-rw-r--r--testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat2
-rw-r--r--testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat4
-rw-r--r--testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat4
-rw-r--r--testing/tests/gcrypt-ikev2/alg-camellia/test.conf10
-rw-r--r--testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat4
-rw-r--r--testing/tests/gcrypt-ikev2/rw-cert/posttest.dat6
-rw-r--r--testing/tests/gcrypt-ikev2/rw-cert/pretest.dat6
-rw-r--r--testing/tests/gcrypt-ikev2/rw-cert/test.conf10
-rw-r--r--testing/tests/ha/both-active/evaltest.dat4
-rwxr-xr-xtesting/tests/ha/both-active/hosts/alice/etc/init.d/iptables104
-rw-r--r--testing/tests/ha/both-active/hosts/alice/etc/iptables.rules50
-rwxr-xr-xtesting/tests/ha/both-active/hosts/moon/etc/init.d/iptables104
-rw-r--r--testing/tests/ha/both-active/hosts/moon/etc/iptables.rules50
-rw-r--r--testing/tests/ha/both-active/posttest.dat10
-rw-r--r--testing/tests/ha/both-active/pretest.dat10
-rw-r--r--testing/tests/ha/both-active/test.conf10
-rw-r--r--testing/tests/ike/rw-cert/evaltest.dat4
-rw-r--r--testing/tests/ike/rw-cert/pretest.dat1
-rw-r--r--testing/tests/ike/rw-cert/test.conf10
-rw-r--r--testing/tests/ike/rw_v1-net_v2/evaltest.dat4
-rw-r--r--testing/tests/ike/rw_v1-net_v2/pretest.dat2
-rw-r--r--testing/tests/ike/rw_v1-net_v2/test.conf10
-rw-r--r--testing/tests/ikev1/alg-3des-md5/evaltest.dat6
-rw-r--r--testing/tests/ikev1/alg-3des-md5/posttest.dat4
-rw-r--r--testing/tests/ikev1/alg-3des-md5/pretest.dat4
-rw-r--r--testing/tests/ikev1/alg-3des-md5/test.conf10
-rw-r--r--testing/tests/ikev1/alg-blowfish/evaltest.dat4
-rw-r--r--testing/tests/ikev1/alg-blowfish/posttest.dat6
-rw-r--r--testing/tests/ikev1/alg-blowfish/pretest.dat6
-rw-r--r--testing/tests/ikev1/alg-blowfish/test.conf10
-rw-r--r--testing/tests/ikev1/alg-modp-subgroup/evaltest.dat4
-rw-r--r--testing/tests/ikev1/alg-modp-subgroup/posttest.dat6
-rw-r--r--testing/tests/ikev1/alg-modp-subgroup/pretest.dat6
-rw-r--r--testing/tests/ikev1/alg-modp-subgroup/test.conf10
-rw-r--r--testing/tests/ikev1/alg-sha256/evaltest.dat6
-rw-r--r--testing/tests/ikev1/alg-sha256/posttest.dat4
-rw-r--r--testing/tests/ikev1/alg-sha256/pretest.dat4
-rw-r--r--testing/tests/ikev1/alg-sha256/test.conf10
-rw-r--r--testing/tests/ikev1/alg-sha384/evaltest.dat6
-rw-r--r--testing/tests/ikev1/alg-sha384/posttest.dat4
-rw-r--r--testing/tests/ikev1/alg-sha384/pretest.dat4
-rw-r--r--testing/tests/ikev1/alg-sha384/test.conf10
-rw-r--r--testing/tests/ikev1/alg-sha512/evaltest.dat6
-rw-r--r--testing/tests/ikev1/alg-sha512/posttest.dat4
-rw-r--r--testing/tests/ikev1/alg-sha512/pretest.dat4
-rw-r--r--testing/tests/ikev1/alg-sha512/test.conf10
-rw-r--r--testing/tests/ikev1/compress/pretest.dat1
-rw-r--r--testing/tests/ikev1/compress/test.conf10
-rw-r--r--testing/tests/ikev1/config-payload/evaltest.dat4
-rw-r--r--testing/tests/ikev1/config-payload/posttest.dat6
-rw-r--r--testing/tests/ikev1/config-payload/pretest.dat6
-rw-r--r--testing/tests/ikev1/config-payload/test.conf10
-rw-r--r--testing/tests/ikev1/double-nat-net/evaltest.dat6
-rw-r--r--testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules24
-rw-r--r--testing/tests/ikev1/double-nat-net/posttest.dat4
-rw-r--r--testing/tests/ikev1/double-nat-net/pretest.dat7
-rw-r--r--testing/tests/ikev1/double-nat-net/test.conf10
-rw-r--r--testing/tests/ikev1/double-nat/evaltest.dat6
-rw-r--r--testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules24
-rw-r--r--testing/tests/ikev1/double-nat/posttest.dat4
-rw-r--r--testing/tests/ikev1/double-nat/pretest.dat6
-rw-r--r--testing/tests/ikev1/double-nat/test.conf10
-rw-r--r--testing/tests/ikev1/dpd-clear/test.conf10
-rw-r--r--testing/tests/ikev1/dpd-restart/test.conf10
-rw-r--r--testing/tests/ikev1/dynamic-initiator/evaltest.dat2
-rw-r--r--testing/tests/ikev1/dynamic-initiator/posttest.dat4
-rw-r--r--testing/tests/ikev1/dynamic-initiator/pretest.dat6
-rw-r--r--testing/tests/ikev1/dynamic-initiator/test.conf10
-rw-r--r--testing/tests/ikev1/dynamic-responder/evaltest.dat2
-rw-r--r--testing/tests/ikev1/dynamic-responder/posttest.dat4
-rw-r--r--testing/tests/ikev1/dynamic-responder/pretest.dat6
-rw-r--r--testing/tests/ikev1/dynamic-responder/test.conf10
-rw-r--r--testing/tests/ikev1/dynamic-two-peers/evaltest.dat4
-rw-r--r--testing/tests/ikev1/dynamic-two-peers/posttest.dat6
-rw-r--r--testing/tests/ikev1/dynamic-two-peers/pretest.dat6
-rw-r--r--testing/tests/ikev1/dynamic-two-peers/test.conf10
-rw-r--r--testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat2
-rw-r--r--testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-aes-ccm/test.conf10
-rw-r--r--testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat2
-rw-r--r--testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-aes-ctr/test.conf10
-rw-r--r--testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat2
-rw-r--r--testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-aes-gcm/test.conf10
-rw-r--r--testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat2
-rw-r--r--testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-aes-gmac/test.conf10
-rw-r--r--testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat6
-rw-r--r--testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat1
-rw-r--r--testing/tests/ikev1/esp-alg-aes-xcbc/test.conf10
-rw-r--r--testing/tests/ikev1/esp-alg-null/evaltest.dat2
-rw-r--r--testing/tests/ikev1/esp-alg-null/posttest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-null/pretest.dat4
-rw-r--r--testing/tests/ikev1/esp-alg-null/test.conf10
-rw-r--r--testing/tests/ikev1/host2host-cert/evaltest.dat2
-rw-r--r--testing/tests/ikev1/host2host-cert/posttest.dat4
-rw-r--r--testing/tests/ikev1/host2host-cert/pretest.dat4
-rw-r--r--testing/tests/ikev1/host2host-cert/test.conf10
-rw-r--r--testing/tests/ikev1/host2host-transport/evaltest.dat2
-rw-r--r--testing/tests/ikev1/host2host-transport/posttest.dat4
-rw-r--r--testing/tests/ikev1/host2host-transport/pretest.dat4
-rw-r--r--testing/tests/ikev1/host2host-transport/test.conf10
-rw-r--r--testing/tests/ikev1/ip-pool-db/evaltest.dat4
-rw-r--r--testing/tests/ikev1/ip-pool-db/posttest.dat6
-rw-r--r--testing/tests/ikev1/ip-pool-db/pretest.dat6
-rw-r--r--testing/tests/ikev1/ip-pool-db/test.conf10
-rw-r--r--testing/tests/ikev1/ip-pool/evaltest.dat4
-rw-r--r--testing/tests/ikev1/ip-pool/posttest.dat6
-rw-r--r--testing/tests/ikev1/ip-pool/pretest.dat6
-rw-r--r--testing/tests/ikev1/ip-pool/test.conf10
-rw-r--r--testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat1
-rw-r--r--testing/tests/ikev1/multi-level-ca-cr-init/test.conf10
-rw-r--r--testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat1
-rw-r--r--testing/tests/ikev1/multi-level-ca-cr-resp/test.conf10
-rw-r--r--testing/tests/ikev1/multi-level-ca/pretest.dat1
-rw-r--r--testing/tests/ikev1/multi-level-ca/test.conf10
-rw-r--r--testing/tests/ikev1/nat-rw/evaltest.dat14
-rw-r--r--testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules24
-rw-r--r--testing/tests/ikev1/nat-rw/posttest.dat6
-rw-r--r--testing/tests/ikev1/nat-rw/pretest.dat7
-rw-r--r--testing/tests/ikev1/nat-rw/test.conf10
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/description.txt6
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/evaltest.dat8
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts70
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf22
-rwxr-xr-xtesting/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown152
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf6
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf22
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf6
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/posttest.dat6
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/pretest.dat8
-rw-r--r--testing/tests/ikev1/nat-virtual-ip/test.conf21
-rw-r--r--testing/tests/ikev1/net2net-cert/evaltest.dat2
-rw-r--r--testing/tests/ikev1/net2net-cert/posttest.dat4
-rw-r--r--testing/tests/ikev1/net2net-cert/pretest.dat4
-rw-r--r--testing/tests/ikev1/net2net-cert/test.conf10
-rw-r--r--testing/tests/ikev1/net2net-psk-fail/posttest.dat4
-rw-r--r--testing/tests/ikev1/net2net-psk-fail/pretest.dat4
-rw-r--r--testing/tests/ikev1/net2net-psk-fail/test.conf10
-rw-r--r--testing/tests/ikev1/net2net-psk/evaltest.dat2
-rw-r--r--testing/tests/ikev1/net2net-psk/posttest.dat4
-rw-r--r--testing/tests/ikev1/net2net-psk/pretest.dat4
-rw-r--r--testing/tests/ikev1/net2net-psk/test.conf10
-rw-r--r--testing/tests/ikev1/protoport-dual/evaltest.dat4
-rw-r--r--testing/tests/ikev1/protoport-dual/posttest.dat4
-rw-r--r--testing/tests/ikev1/protoport-dual/pretest.dat4
-rw-r--r--testing/tests/ikev1/protoport-dual/test.conf10
-rw-r--r--testing/tests/ikev1/rw-cert-aggressive/evaltest.dat4
-rw-r--r--testing/tests/ikev1/rw-cert-aggressive/posttest.dat6
-rw-r--r--testing/tests/ikev1/rw-cert-aggressive/pretest.dat6
-rw-r--r--testing/tests/ikev1/rw-cert-aggressive/test.conf10
-rw-r--r--testing/tests/ikev1/rw-cert-unity/evaltest.dat2
-rw-r--r--testing/tests/ikev1/rw-cert-unity/test.conf10
-rw-r--r--testing/tests/ikev1/rw-cert/evaltest.dat4
-rw-r--r--testing/tests/ikev1/rw-cert/posttest.dat6
-rw-r--r--testing/tests/ikev1/rw-cert/pretest.dat6
-rw-r--r--testing/tests/ikev1/rw-cert/test.conf10
-rw-r--r--testing/tests/ikev1/rw-psk-aggressive/evaltest.dat4
-rw-r--r--testing/tests/ikev1/rw-psk-aggressive/posttest.dat6
-rw-r--r--testing/tests/ikev1/rw-psk-aggressive/pretest.dat6
-rw-r--r--testing/tests/ikev1/rw-psk-aggressive/test.conf10
-rw-r--r--testing/tests/ikev1/rw-psk-fqdn/evaltest.dat4
-rw-r--r--testing/tests/ikev1/rw-psk-fqdn/posttest.dat6
-rw-r--r--testing/tests/ikev1/rw-psk-fqdn/pretest.dat6
-rw-r--r--testing/tests/ikev1/rw-psk-fqdn/test.conf10
-rw-r--r--testing/tests/ikev1/rw-psk-ipv4/evaltest.dat4
-rw-r--r--testing/tests/ikev1/rw-psk-ipv4/posttest.dat6
-rw-r--r--testing/tests/ikev1/rw-psk-ipv4/pretest.dat6
-rw-r--r--testing/tests/ikev1/rw-psk-ipv4/test.conf10
-rw-r--r--testing/tests/ikev1/virtual-ip/evaltest.dat12
-rw-r--r--testing/tests/ikev1/virtual-ip/posttest.dat6
-rw-r--r--testing/tests/ikev1/virtual-ip/pretest.dat6
-rw-r--r--testing/tests/ikev1/virtual-ip/test.conf10
-rw-r--r--testing/tests/ikev1/xauth-id-psk-config/evaltest.dat4
-rw-r--r--testing/tests/ikev1/xauth-id-psk-config/posttest.dat6
-rw-r--r--testing/tests/ikev1/xauth-id-psk-config/pretest.dat6
-rw-r--r--testing/tests/ikev1/xauth-id-psk-config/test.conf10
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat4
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat6
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat6
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf10
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat4
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-config/posttest.dat6
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-config/pretest.dat6
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-config/test.conf10
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat4
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat6
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat6
-rw-r--r--testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf10
-rw-r--r--testing/tests/ikev1/xauth-psk/evaltest.dat4
-rw-r--r--testing/tests/ikev1/xauth-psk/posttest.dat6
-rw-r--r--testing/tests/ikev1/xauth-psk/pretest.dat6
-rw-r--r--testing/tests/ikev1/xauth-psk/test.conf10
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat2
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/eap.conf)0
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf120
-rwxr-xr-xtesting/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat6
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat6
-rw-r--r--testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf12
-rw-r--r--testing/tests/ikev1/xauth-rsa/evaltest.dat4
-rw-r--r--testing/tests/ikev1/xauth-rsa/posttest.dat6
-rw-r--r--testing/tests/ikev1/xauth-rsa/pretest.dat6
-rw-r--r--testing/tests/ikev1/xauth-rsa/test.conf10
-rw-r--r--testing/tests/ikev2/after-2038-certs/evaltest.dat2
-rw-r--r--testing/tests/ikev2/after-2038-certs/posttest.dat4
-rw-r--r--testing/tests/ikev2/after-2038-certs/pretest.dat4
-rw-r--r--testing/tests/ikev2/after-2038-certs/test.conf10
-rw-r--r--testing/tests/ikev2/alg-3des-md5/evaltest.dat6
-rw-r--r--testing/tests/ikev2/alg-3des-md5/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-3des-md5/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-3des-md5/test.conf10
-rw-r--r--testing/tests/ikev2/alg-aes-ccm/evaltest.dat2
-rw-r--r--testing/tests/ikev2/alg-aes-ccm/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-aes-ccm/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-aes-ccm/test.conf10
-rw-r--r--testing/tests/ikev2/alg-aes-ctr/evaltest.dat2
-rw-r--r--testing/tests/ikev2/alg-aes-ctr/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-aes-ctr/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-aes-ctr/test.conf10
-rw-r--r--testing/tests/ikev2/alg-aes-gcm/evaltest.dat2
-rw-r--r--testing/tests/ikev2/alg-aes-gcm/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-aes-gcm/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-aes-gcm/test.conf10
-rw-r--r--testing/tests/ikev2/alg-aes-xcbc/evaltest.dat6
-rw-r--r--testing/tests/ikev2/alg-aes-xcbc/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-aes-xcbc/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-aes-xcbc/test.conf10
-rw-r--r--testing/tests/ikev2/alg-blowfish/evaltest.dat4
-rw-r--r--testing/tests/ikev2/alg-blowfish/posttest.dat6
-rw-r--r--testing/tests/ikev2/alg-blowfish/pretest.dat6
-rw-r--r--testing/tests/ikev2/alg-blowfish/test.conf10
-rw-r--r--testing/tests/ikev2/alg-modp-subgroup/evaltest.dat4
-rw-r--r--testing/tests/ikev2/alg-modp-subgroup/posttest.dat6
-rw-r--r--testing/tests/ikev2/alg-modp-subgroup/pretest.dat6
-rw-r--r--testing/tests/ikev2/alg-modp-subgroup/test.conf10
-rw-r--r--testing/tests/ikev2/alg-sha256-96/evaltest.dat6
-rw-r--r--testing/tests/ikev2/alg-sha256-96/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-sha256-96/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-sha256-96/test.conf10
-rw-r--r--testing/tests/ikev2/alg-sha256/evaltest.dat6
-rw-r--r--testing/tests/ikev2/alg-sha256/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-sha256/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-sha256/test.conf10
-rw-r--r--testing/tests/ikev2/alg-sha384/evaltest.dat6
-rw-r--r--testing/tests/ikev2/alg-sha384/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-sha384/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-sha384/test.conf10
-rw-r--r--testing/tests/ikev2/alg-sha512/evaltest.dat6
-rw-r--r--testing/tests/ikev2/alg-sha512/posttest.dat4
-rw-r--r--testing/tests/ikev2/alg-sha512/pretest.dat4
-rw-r--r--testing/tests/ikev2/alg-sha512/test.conf10
-rw-r--r--testing/tests/ikev2/any-interface/pretest.dat2
-rw-r--r--testing/tests/ikev2/any-interface/test.conf10
-rw-r--r--testing/tests/ikev2/compress/pretest.dat1
-rw-r--r--testing/tests/ikev2/compress/test.conf10
-rw-r--r--testing/tests/ikev2/config-payload-swapped/evaltest.dat4
-rw-r--r--testing/tests/ikev2/config-payload-swapped/posttest.dat6
-rw-r--r--testing/tests/ikev2/config-payload-swapped/pretest.dat6
-rw-r--r--testing/tests/ikev2/config-payload-swapped/test.conf10
-rw-r--r--testing/tests/ikev2/config-payload/evaltest.dat4
-rw-r--r--testing/tests/ikev2/config-payload/posttest.dat6
-rw-r--r--testing/tests/ikev2/config-payload/pretest.dat6
-rw-r--r--testing/tests/ikev2/config-payload/test.conf10
-rw-r--r--testing/tests/ikev2/critical-extension/posttest.dat4
-rw-r--r--testing/tests/ikev2/critical-extension/pretest.dat4
-rw-r--r--testing/tests/ikev2/critical-extension/test.conf10
-rw-r--r--testing/tests/ikev2/crl-from-cache/test.conf10
-rwxr-xr-xtesting/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables77
-rw-r--r--testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules28
-rwxr-xr-xtesting/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables80
-rw-r--r--testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules28
-rw-r--r--testing/tests/ikev2/crl-ldap/posttest.dat4
-rw-r--r--testing/tests/ikev2/crl-ldap/pretest.dat4
-rw-r--r--testing/tests/ikev2/crl-ldap/test.conf10
-rw-r--r--testing/tests/ikev2/crl-revoked/test.conf10
-rw-r--r--testing/tests/ikev2/crl-to-cache/test.conf10
-rw-r--r--testing/tests/ikev2/default-keys/description.txt6
-rw-r--r--testing/tests/ikev2/default-keys/evaltest.dat2
-rwxr-xr-xtesting/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables82
-rw-r--r--testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules30
-rw-r--r--testing/tests/ikev2/default-keys/posttest.dat4
-rw-r--r--testing/tests/ikev2/default-keys/pretest.dat11
-rw-r--r--testing/tests/ikev2/default-keys/test.conf10
-rw-r--r--testing/tests/ikev2/dhcp-dynamic/evaltest.dat12
-rwxr-xr-xtesting/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables91
-rw-r--r--testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules39
-rw-r--r--testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcp/dhcpd.conf (renamed from testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf)8
-rw-r--r--testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf6
-rwxr-xr-xtesting/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd24
-rw-r--r--testing/tests/ikev2/dhcp-dynamic/posttest.dat8
-rw-r--r--testing/tests/ikev2/dhcp-dynamic/pretest.dat12
-rw-r--r--testing/tests/ikev2/dhcp-dynamic/test.conf10
-rw-r--r--testing/tests/ikev2/dhcp-static-client-id/evaltest.dat12
-rwxr-xr-xtesting/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables91
-rw-r--r--testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules39
-rw-r--r--testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcp/dhcpd.conf (renamed from testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcpd.conf)9
-rw-r--r--testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf6
-rwxr-xr-xtesting/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd24
-rw-r--r--testing/tests/ikev2/dhcp-static-client-id/posttest.dat8
-rw-r--r--testing/tests/ikev2/dhcp-static-client-id/pretest.dat12
-rw-r--r--testing/tests/ikev2/dhcp-static-client-id/test.conf10
-rw-r--r--testing/tests/ikev2/dhcp-static-mac/evaltest.dat12
-rwxr-xr-xtesting/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables91
-rw-r--r--testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules39
-rw-r--r--testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcp/dhcpd.conf (renamed from testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcpd.conf)9
-rw-r--r--testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf6
-rwxr-xr-xtesting/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd24
-rw-r--r--testing/tests/ikev2/dhcp-static-mac/posttest.dat8
-rw-r--r--testing/tests/ikev2/dhcp-static-mac/pretest.dat12
-rw-r--r--testing/tests/ikev2/dhcp-static-mac/test.conf10
-rw-r--r--testing/tests/ikev2/double-nat-net/evaltest.dat6
-rw-r--r--testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules24
-rw-r--r--testing/tests/ikev2/double-nat-net/posttest.dat4
-rw-r--r--testing/tests/ikev2/double-nat-net/pretest.dat7
-rw-r--r--testing/tests/ikev2/double-nat-net/test.conf10
-rw-r--r--testing/tests/ikev2/double-nat/evaltest.dat6
-rw-r--r--testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules24
-rw-r--r--testing/tests/ikev2/double-nat/posttest.dat4
-rw-r--r--testing/tests/ikev2/double-nat/pretest.dat6
-rw-r--r--testing/tests/ikev2/double-nat/test.conf10
-rw-r--r--testing/tests/ikev2/dpd-clear/test.conf10
-rw-r--r--testing/tests/ikev2/dpd-hold/test.conf10
-rw-r--r--testing/tests/ikev2/dpd-restart/test.conf10
-rw-r--r--testing/tests/ikev2/dynamic-initiator/evaltest.dat2
-rw-r--r--testing/tests/ikev2/dynamic-initiator/posttest.dat6
-rw-r--r--testing/tests/ikev2/dynamic-initiator/pretest.dat6
-rw-r--r--testing/tests/ikev2/dynamic-initiator/test.conf10
-rw-r--r--testing/tests/ikev2/dynamic-two-peers/evaltest.dat4
-rw-r--r--testing/tests/ikev2/dynamic-two-peers/posttest.dat6
-rw-r--r--testing/tests/ikev2/dynamic-two-peers/pretest.dat6
-rw-r--r--testing/tests/ikev2/dynamic-two-peers/test.conf10
-rw-r--r--testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat2
-rw-r--r--testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat4
-rw-r--r--testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat4
-rw-r--r--testing/tests/ikev2/esp-alg-aes-gmac/test.conf10
-rw-r--r--testing/tests/ikev2/esp-alg-md5-128/evaltest.dat6
-rw-r--r--testing/tests/ikev2/esp-alg-md5-128/posttest.dat4
-rw-r--r--testing/tests/ikev2/esp-alg-md5-128/pretest.dat4
-rw-r--r--testing/tests/ikev2/esp-alg-md5-128/test.conf10
-rw-r--r--testing/tests/ikev2/esp-alg-null/evaltest.dat2
-rw-r--r--testing/tests/ikev2/esp-alg-null/posttest.dat4
-rw-r--r--testing/tests/ikev2/esp-alg-null/pretest.dat4
-rw-r--r--testing/tests/ikev2/esp-alg-null/test.conf10
-rw-r--r--testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat6
-rw-r--r--testing/tests/ikev2/esp-alg-sha1-160/posttest.dat4
-rw-r--r--testing/tests/ikev2/esp-alg-sha1-160/pretest.dat4
-rw-r--r--testing/tests/ikev2/esp-alg-sha1-160/test.conf10
-rw-r--r--testing/tests/ikev2/farp/evaltest.dat12
-rw-r--r--testing/tests/ikev2/farp/posttest.dat6
-rw-r--r--testing/tests/ikev2/farp/pretest.dat6
-rw-r--r--testing/tests/ikev2/farp/test.conf10
-rw-r--r--testing/tests/ikev2/force-udp-encaps/evaltest.dat6
-rwxr-xr-xtesting/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables76
-rw-r--r--testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules24
-rw-r--r--testing/tests/ikev2/force-udp-encaps/posttest.dat4
-rw-r--r--testing/tests/ikev2/force-udp-encaps/pretest.dat5
-rw-r--r--testing/tests/ikev2/force-udp-encaps/test.conf10
-rw-r--r--testing/tests/ikev2/host2host-cert/evaltest.dat2
-rw-r--r--testing/tests/ikev2/host2host-cert/posttest.dat4
-rw-r--r--testing/tests/ikev2/host2host-cert/pretest.dat4
-rw-r--r--testing/tests/ikev2/host2host-cert/test.conf10
-rw-r--r--testing/tests/ikev2/host2host-swapped/evaltest.dat2
-rw-r--r--testing/tests/ikev2/host2host-swapped/posttest.dat4
-rw-r--r--testing/tests/ikev2/host2host-swapped/pretest.dat4
-rw-r--r--testing/tests/ikev2/host2host-swapped/test.conf10
-rw-r--r--testing/tests/ikev2/host2host-transport/evaltest.dat2
-rw-r--r--testing/tests/ikev2/host2host-transport/posttest.dat4
-rw-r--r--testing/tests/ikev2/host2host-transport/pretest.dat4
-rw-r--r--testing/tests/ikev2/host2host-transport/test.conf10
-rw-r--r--testing/tests/ikev2/inactivity-timeout/evaltest.dat4
-rw-r--r--testing/tests/ikev2/inactivity-timeout/posttest.dat3
-rw-r--r--testing/tests/ikev2/inactivity-timeout/pretest.dat5
-rw-r--r--testing/tests/ikev2/inactivity-timeout/test.conf10
-rw-r--r--testing/tests/ikev2/ip-pool-db/evaltest.dat4
-rw-r--r--testing/tests/ikev2/ip-pool-db/posttest.dat6
-rw-r--r--testing/tests/ikev2/ip-pool-db/pretest.dat6
-rw-r--r--testing/tests/ikev2/ip-pool-db/test.conf10
-rw-r--r--testing/tests/ikev2/ip-pool-wish/evaltest.dat4
-rw-r--r--testing/tests/ikev2/ip-pool-wish/posttest.dat6
-rw-r--r--testing/tests/ikev2/ip-pool-wish/pretest.dat6
-rw-r--r--testing/tests/ikev2/ip-pool-wish/test.conf10
-rw-r--r--testing/tests/ikev2/ip-pool/evaltest.dat8
-rw-r--r--testing/tests/ikev2/ip-pool/posttest.dat6
-rw-r--r--testing/tests/ikev2/ip-pool/pretest.dat6
-rw-r--r--testing/tests/ikev2/ip-pool/test.conf10
-rw-r--r--testing/tests/ikev2/ip-split-pools-db/test.conf10
-rw-r--r--testing/tests/ikev2/ip-two-pools-db/evaltest.dat8
-rwxr-xr-xtesting/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables78
-rwxr-xr-xtesting/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables91
-rw-r--r--testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules43
-rwxr-xr-xtesting/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables78
-rw-r--r--testing/tests/ikev2/ip-two-pools-db/posttest.dat10
-rw-r--r--testing/tests/ikev2/ip-two-pools-db/pretest.dat10
-rw-r--r--testing/tests/ikev2/ip-two-pools-db/test.conf10
-rw-r--r--testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat4
-rwxr-xr-xtesting/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables78
-rwxr-xr-xtesting/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables91
-rw-r--r--testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules43
-rw-r--r--testing/tests/ikev2/ip-two-pools-mixed/posttest.dat6
-rw-r--r--testing/tests/ikev2/ip-two-pools-mixed/pretest.dat6
-rw-r--r--testing/tests/ikev2/ip-two-pools-mixed/test.conf10
-rw-r--r--testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat2
-rw-r--r--testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat1
-rw-r--r--testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat1
-rw-r--r--testing/tests/ikev2/ip-two-pools-v4v6/test.conf10
-rw-r--r--testing/tests/ikev2/ip-two-pools/evaltest.dat8
-rwxr-xr-xtesting/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables78
-rwxr-xr-xtesting/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables91
-rw-r--r--testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules43
-rw-r--r--testing/tests/ikev2/ip-two-pools/posttest.dat6
-rw-r--r--testing/tests/ikev2/ip-two-pools/pretest.dat6
-rw-r--r--testing/tests/ikev2/ip-two-pools/test.conf10
-rw-r--r--testing/tests/ikev2/mobike-nat/evaltest.dat6
-rwxr-xr-xtesting/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables87
-rw-r--r--testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf2
-rw-r--r--testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules38
-rwxr-xr-xtesting/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/mobike-nat/posttest.dat4
-rw-r--r--testing/tests/ikev2/mobike-nat/pretest.dat9
-rw-r--r--testing/tests/ikev2/mobike-nat/test.conf10
-rw-r--r--testing/tests/ikev2/mobike-virtual-ip/evaltest.dat10
-rwxr-xr-xtesting/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables87
-rw-r--r--testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf2
-rw-r--r--testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules38
-rwxr-xr-xtesting/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf2
-rw-r--r--testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/mobike-virtual-ip/posttest.dat4
-rw-r--r--testing/tests/ikev2/mobike-virtual-ip/pretest.dat9
-rw-r--r--testing/tests/ikev2/mobike-virtual-ip/test.conf10
-rw-r--r--testing/tests/ikev2/mobike/evaltest.dat14
-rwxr-xr-xtesting/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables87
-rw-r--r--testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf2
-rw-r--r--testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules38
-rwxr-xr-xtesting/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables90
-rw-r--r--testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf2
-rw-r--r--testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/mobike/posttest.dat4
-rw-r--r--testing/tests/ikev2/mobike/pretest.dat9
-rw-r--r--testing/tests/ikev2/mobike/test.conf10
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat4
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf5
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files3
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/triplets.dat (renamed from testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/triplets.dat)1
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf5
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf123
-rwxr-xr-xtesting/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat5
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat13
-rw-r--r--testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf14
-rw-r--r--testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat1
-rw-r--r--testing/tests/ikev2/multi-level-ca-cr-init/test.conf10
-rw-r--r--testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat1
-rw-r--r--testing/tests/ikev2/multi-level-ca-cr-resp/test.conf10
-rwxr-xr-xtesting/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables80
-rw-r--r--testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules28
-rw-r--r--testing/tests/ikev2/multi-level-ca-ldap/posttest.dat2
-rw-r--r--testing/tests/ikev2/multi-level-ca-ldap/pretest.dat2
-rw-r--r--testing/tests/ikev2/multi-level-ca-ldap/test.conf10
-rw-r--r--testing/tests/ikev2/multi-level-ca-loop/pretest.dat1
-rw-r--r--testing/tests/ikev2/multi-level-ca-loop/test.conf10
-rw-r--r--testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat1
-rw-r--r--testing/tests/ikev2/multi-level-ca-pathlen/test.conf10
-rw-r--r--testing/tests/ikev2/multi-level-ca-revoked/test.conf10
-rw-r--r--testing/tests/ikev2/multi-level-ca-strict/pretest.dat1
-rw-r--r--testing/tests/ikev2/multi-level-ca-strict/test.conf10
-rw-r--r--testing/tests/ikev2/multi-level-ca/pretest.dat1
-rw-r--r--testing/tests/ikev2/multi-level-ca/test.conf10
-rw-r--r--testing/tests/ikev2/nat-rw-mark/description.txt2
-rw-r--r--testing/tests/ikev2/nat-rw-mark/evaltest.dat20
-rw-r--r--testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules24
-rwxr-xr-xtesting/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown16
-rw-r--r--testing/tests/ikev2/nat-rw-mark/posttest.dat9
-rw-r--r--testing/tests/ikev2/nat-rw-mark/pretest.dat19
-rw-r--r--testing/tests/ikev2/nat-rw-mark/test.conf10
-rw-r--r--testing/tests/ikev2/nat-rw-psk/evaltest.dat8
-rw-r--r--testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules24
-rw-r--r--testing/tests/ikev2/nat-rw-psk/posttest.dat6
-rw-r--r--testing/tests/ikev2/nat-rw-psk/pretest.dat7
-rw-r--r--testing/tests/ikev2/nat-rw-psk/test.conf10
-rw-r--r--testing/tests/ikev2/nat-rw/evaltest.dat14
-rw-r--r--testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules24
-rw-r--r--testing/tests/ikev2/nat-rw/posttest.dat6
-rw-r--r--testing/tests/ikev2/nat-rw/pretest.dat7
-rw-r--r--testing/tests/ikev2/nat-rw/test.conf10
-rw-r--r--testing/tests/ikev2/nat-virtual-ip/evaltest.dat2
-rw-r--r--testing/tests/ikev2/nat-virtual-ip/posttest.dat4
-rw-r--r--testing/tests/ikev2/nat-virtual-ip/pretest.dat5
-rw-r--r--testing/tests/ikev2/nat-virtual-ip/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-cert/evaltest.dat2
-rw-r--r--testing/tests/ikev2/net2net-cert/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-cert/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-cert/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-esn/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-esn/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-esn/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-pgp-v3/evaltest.dat2
-rw-r--r--testing/tests/ikev2/net2net-pgp-v3/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-pgp-v3/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-pgp-v3/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-pgp-v4/evaltest.dat2
-rw-r--r--testing/tests/ikev2/net2net-pgp-v4/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-pgp-v4/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-pgp-v4/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-psk-dscp/evaltest.dat4
-rw-r--r--testing/tests/ikev2/net2net-psk-dscp/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-psk-dscp/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-psk-dscp/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-psk-fail/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-psk-fail/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-psk-fail/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-psk/evaltest.dat2
-rw-r--r--testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets2
-rw-r--r--testing/tests/ikev2/net2net-psk/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-psk/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-psk/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-pubkey/evaltest.dat2
-rw-r--r--testing/tests/ikev2/net2net-pubkey/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-pubkey/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-pubkey/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-rfc3779/evaltest.dat6
-rw-r--r--testing/tests/ikev2/net2net-rfc3779/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-rfc3779/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-rfc3779/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-route/evaltest.dat2
-rw-r--r--testing/tests/ikev2/net2net-route/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-route/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-route/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-rsa/evaltest.dat2
-rw-r--r--testing/tests/ikev2/net2net-rsa/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-rsa/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-rsa/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-same-nets/evaltest.dat4
-rwxr-xr-xtesting/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown24
-rw-r--r--testing/tests/ikev2/net2net-same-nets/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-same-nets/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-same-nets/test.conf10
-rw-r--r--testing/tests/ikev2/net2net-start/evaltest.dat2
-rw-r--r--testing/tests/ikev2/net2net-start/posttest.dat4
-rw-r--r--testing/tests/ikev2/net2net-start/pretest.dat4
-rw-r--r--testing/tests/ikev2/net2net-start/test.conf10
-rwxr-xr-xtesting/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi8
-rw-r--r--testing/tests/ikev2/ocsp-local-cert/test.conf10
-rw-r--r--testing/tests/ikev2/ocsp-multi-level/pretest.dat1
-rw-r--r--testing/tests/ikev2/ocsp-multi-level/test.conf10
-rwxr-xr-xtesting/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi8
-rw-r--r--testing/tests/ikev2/ocsp-no-signer-cert/test.conf10
-rw-r--r--testing/tests/ikev2/ocsp-revoked/test.conf10
-rwxr-xr-xtesting/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi8
-rw-r--r--testing/tests/ikev2/ocsp-root-cert/test.conf10
-rw-r--r--testing/tests/ikev2/ocsp-signer-cert/test.conf10
-rw-r--r--testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat1
-rw-r--r--testing/tests/ikev2/ocsp-strict-ifuri/test.conf10
-rwxr-xr-xtesting/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi10
-rw-r--r--testing/tests/ikev2/ocsp-timeouts-good/test.conf10
-rw-r--r--testing/tests/ikev2/ocsp-timeouts-unknown/test.conf10
-rwxr-xr-xtesting/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi8
-rw-r--r--testing/tests/ikev2/ocsp-untrusted-cert/test.conf10
-rw-r--r--testing/tests/ikev2/protoport-dual/evaltest.dat4
-rw-r--r--testing/tests/ikev2/protoport-dual/posttest.dat4
-rw-r--r--testing/tests/ikev2/protoport-dual/pretest.dat4
-rw-r--r--testing/tests/ikev2/protoport-dual/test.conf10
-rw-r--r--testing/tests/ikev2/protoport-route/evaltest.dat4
-rw-r--r--testing/tests/ikev2/protoport-route/posttest.dat4
-rw-r--r--testing/tests/ikev2/protoport-route/pretest.dat4
-rw-r--r--testing/tests/ikev2/protoport-route/test.conf10
-rw-r--r--testing/tests/ikev2/reauth-early/evaltest.dat2
-rw-r--r--testing/tests/ikev2/reauth-early/posttest.dat4
-rw-r--r--testing/tests/ikev2/reauth-early/pretest.dat4
-rw-r--r--testing/tests/ikev2/reauth-early/test.conf10
-rw-r--r--testing/tests/ikev2/reauth-late/evaltest.dat2
-rw-r--r--testing/tests/ikev2/reauth-late/posttest.dat4
-rw-r--r--testing/tests/ikev2/reauth-late/pretest.dat4
-rw-r--r--testing/tests/ikev2/reauth-late/test.conf10
-rw-r--r--testing/tests/ikev2/rw-cert/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-cert/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-cert/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-cert/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-aka-rsa/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-dynamic/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-dynamic/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-dynamic/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-dynamic/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/description.txt9
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat26
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/eap.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users4
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.conf29
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.secrets3
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/strongswan.conf5
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.conf29
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.secrets3
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/strongswan.conf5
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.conf33
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.secrets3
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/strongswan.conf12
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat7
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat13
-rw-r--r--testing/tests/ikev2/rw-eap-md5-class-radius/test.conf26
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat8
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/eap.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf120
-rwxr-xr-xtesting/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-md5-id-radius/test.conf12
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/eap.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf120
-rwxr-xr-xtesting/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-md5-radius/test.conf12
-rw-r--r--testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-md5-rsa/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-peap-md5/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-peap-md5/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-peap-md5/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/eap.conf)2
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel (renamed from testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel)0
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf4
-rwxr-xr-xtesting/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/posttest.dat8
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/pretest.dat8
-rw-r--r--testing/tests/ikev2/rw-eap-peap-radius/test.conf12
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf5
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files3
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/triplets.dat (renamed from testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/triplets.dat)0
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf5
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf123
-rwxr-xr-xtesting/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat8
-rw-r--r--testing/tests/ikev2/rw-eap-sim-id-radius/test.conf12
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf5
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files3
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/triplets.dat (renamed from testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/triplets.dat)1
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf5
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf123
-rwxr-xr-xtesting/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat8
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat10
-rw-r--r--testing/tests/ikev2/rw-eap-sim-only-radius/test.conf12
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf5
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/triplets.dat (renamed from testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/triplets.dat)1
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf5
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf123
-rwxr-xr-xtesting/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/posttest.dat8
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/pretest.dat16
-rw-r--r--testing/tests/ikev2/rw-eap-sim-radius/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-sim-rsa/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-tls-fragments/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-tls-only/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-tls-only/posttest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-tls-only/pretest.dat4
-rw-r--r--testing/tests/ikev2/rw-eap-tls-only/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/eap.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf120
-rwxr-xr-xtesting/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-tls-radius/test.conf12
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-only/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-only/pretest.dat10
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-only/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf10
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat2
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/eap.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/default (renamed from testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default)1
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel (renamed from testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel)0
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf120
-rwxr-xr-xtesting/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat8
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat8
-rw-r--r--testing/tests/ikev2/rw-eap-ttls-radius/test.conf12
-rw-r--r--testing/tests/ikev2/rw-hash-and-url/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-hash-and-url/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-hash-and-url/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-hash-and-url/test.conf10
-rw-r--r--testing/tests/ikev2/rw-mark-in-out/description.txt4
-rw-r--r--testing/tests/ikev2/rw-mark-in-out/evaltest.dat6
-rwxr-xr-xtesting/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables77
-rwxr-xr-xtesting/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown16
-rwxr-xr-xtesting/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables77
-rw-r--r--testing/tests/ikev2/rw-mark-in-out/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-mark-in-out/pretest.dat15
-rw-r--r--testing/tests/ikev2/rw-mark-in-out/test.conf10
-rw-r--r--testing/tests/ikev2/rw-pkcs8/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-pkcs8/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-pkcs8/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-pkcs8/test.conf10
-rw-r--r--testing/tests/ikev2/rw-psk-fqdn/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-psk-fqdn/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-fqdn/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-fqdn/test.conf10
-rw-r--r--testing/tests/ikev2/rw-psk-ipv4/evaltest.dat12
-rw-r--r--testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets2
-rw-r--r--testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets2
-rw-r--r--testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets4
-rw-r--r--testing/tests/ikev2/rw-psk-ipv4/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-ipv4/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-ipv4/test.conf10
-rw-r--r--testing/tests/ikev2/rw-psk-no-idr/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-psk-no-idr/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-no-idr/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-no-idr/test.conf10
-rw-r--r--testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-rsa-mixed/test.conf10
-rw-r--r--testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-psk-rsa-split/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-rsa-split/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-psk-rsa-split/test.conf10
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/evaltest.dat6
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf5
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf5
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default42
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/users (renamed from testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf120
-rwxr-xr-xtesting/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables88
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules36
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/posttest.dat9
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/pretest.dat8
-rw-r--r--testing/tests/ikev2/rw-radius-accounting/test.conf12
-rw-r--r--testing/tests/ikev2/rw-whitelist/evaltest.dat4
-rw-r--r--testing/tests/ikev2/rw-whitelist/posttest.dat6
-rw-r--r--testing/tests/ikev2/rw-whitelist/pretest.dat6
-rw-r--r--testing/tests/ikev2/rw-whitelist/test.conf10
-rw-r--r--testing/tests/ikev2/shunt-policies/evaltest.dat20
-rwxr-xr-xtesting/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf2
-rw-r--r--testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/ikev2/shunt-policies/posttest.dat4
-rw-r--r--testing/tests/ikev2/shunt-policies/pretest.dat4
-rw-r--r--testing/tests/ikev2/shunt-policies/test.conf10
-rw-r--r--testing/tests/ikev2/strong-keys-certs/evaltest.dat4
-rw-r--r--testing/tests/ikev2/strong-keys-certs/posttest.dat6
-rw-r--r--testing/tests/ikev2/strong-keys-certs/pretest.dat6
-rw-r--r--testing/tests/ikev2/strong-keys-certs/test.conf10
-rw-r--r--testing/tests/ikev2/two-certs/evaltest.dat4
-rw-r--r--testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf4
-rw-r--r--testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf4
-rw-r--r--testing/tests/ikev2/two-certs/posttest.dat4
-rw-r--r--testing/tests/ikev2/two-certs/pretest.dat4
-rw-r--r--testing/tests/ikev2/two-certs/test.conf10
-rw-r--r--testing/tests/ikev2/virtual-ip-override/posttest.dat6
-rw-r--r--testing/tests/ikev2/virtual-ip-override/pretest.dat6
-rw-r--r--testing/tests/ikev2/virtual-ip-override/test.conf10
-rw-r--r--testing/tests/ikev2/virtual-ip/evaltest.dat12
-rw-r--r--testing/tests/ikev2/virtual-ip/posttest.dat6
-rw-r--r--testing/tests/ikev2/virtual-ip/pretest.dat6
-rw-r--r--testing/tests/ikev2/virtual-ip/test.conf10
-rw-r--r--testing/tests/ikev2/wildcards/pretest.dat1
-rw-r--r--testing/tests/ikev2/wildcards/test.conf10
-rwxr-xr-xtesting/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables108
-rwxr-xr-xtesting/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables108
-rw-r--r--testing/tests/ipv6/host2host-ikev1/posttest.dat6
-rw-r--r--testing/tests/ipv6/host2host-ikev1/pretest.dat10
-rw-r--r--testing/tests/ipv6/host2host-ikev1/test.conf10
-rwxr-xr-xtesting/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/host2host-ikev2/posttest.dat6
-rw-r--r--testing/tests/ipv6/host2host-ikev2/pretest.dat10
-rw-r--r--testing/tests/ipv6/host2host-ikev2/test.conf10
-rwxr-xr-xtesting/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables108
-rwxr-xr-xtesting/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables108
-rw-r--r--testing/tests/ipv6/net2net-ikev1/posttest.dat6
-rw-r--r--testing/tests/ipv6/net2net-ikev1/pretest.dat10
-rw-r--r--testing/tests/ipv6/net2net-ikev1/test.conf10
-rwxr-xr-xtesting/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/net2net-ikev2/posttest.dat6
-rw-r--r--testing/tests/ipv6/net2net-ikev2/pretest.dat10
-rw-r--r--testing/tests/ipv6/net2net-ikev2/test.conf10
-rw-r--r--testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat2
-rwxr-xr-xtesting/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables108
-rwxr-xr-xtesting/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables108
-rw-r--r--testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat6
-rw-r--r--testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat10
-rw-r--r--testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf10
-rw-r--r--testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat2
-rwxr-xr-xtesting/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat6
-rw-r--r--testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat10
-rw-r--r--testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf10
-rwxr-xr-xtesting/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules20
-rwxr-xr-xtesting/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables108
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules20
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat10
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat14
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf10
-rwxr-xr-xtesting/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules20
-rwxr-xr-xtesting/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables108
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules20
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat10
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat14
-rw-r--r--testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf10
-rwxr-xr-xtesting/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat6
-rw-r--r--testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat10
-rw-r--r--testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf10
-rwxr-xr-xtesting/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables108
-rw-r--r--testing/tests/ipv6/rw-ikev1/posttest.dat9
-rw-r--r--testing/tests/ipv6/rw-ikev1/pretest.dat14
-rw-r--r--testing/tests/ipv6/rw-ikev1/test.conf10
-rwxr-xr-xtesting/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/rw-ikev2/posttest.dat9
-rw-r--r--testing/tests/ipv6/rw-ikev2/pretest.dat14
-rw-r--r--testing/tests/ipv6/rw-ikev2/test.conf10
-rwxr-xr-xtesting/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables96
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules20
-rwxr-xr-xtesting/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables96
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules20
-rwxr-xr-xtesting/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules20
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat9
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat14
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt10
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat15
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat7
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat11
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf21
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf10
-rwxr-xr-xtesting/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables96
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules20
-rwxr-xr-xtesting/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables96
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules20
-rwxr-xr-xtesting/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules20
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat9
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat14
-rw-r--r--testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf10
-rwxr-xr-xtesting/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables100
-rwxr-xr-xtesting/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables100
-rwxr-xr-xtesting/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables100
-rw-r--r--testing/tests/ipv6/rw-psk-ikev1/posttest.dat9
-rw-r--r--testing/tests/ipv6/rw-psk-ikev1/pretest.dat14
-rw-r--r--testing/tests/ipv6/rw-psk-ikev1/test.conf10
-rwxr-xr-xtesting/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables100
-rwxr-xr-xtesting/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables100
-rwxr-xr-xtesting/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables100
-rw-r--r--testing/tests/ipv6/rw-psk-ikev2/posttest.dat9
-rw-r--r--testing/tests/ipv6/rw-psk-ikev2/pretest.dat14
-rw-r--r--testing/tests/ipv6/rw-psk-ikev2/test.conf10
-rwxr-xr-xtesting/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat9
-rw-r--r--testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat14
-rw-r--r--testing/tests/ipv6/rw-rfc3779-ikev2/test.conf10
-rwxr-xr-xtesting/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables108
-rwxr-xr-xtesting/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables108
-rw-r--r--testing/tests/ipv6/transport-ikev1/posttest.dat6
-rw-r--r--testing/tests/ipv6/transport-ikev1/pretest.dat10
-rw-r--r--testing/tests/ipv6/transport-ikev1/test.conf10
-rwxr-xr-xtesting/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables104
-rwxr-xr-xtesting/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables104
-rw-r--r--testing/tests/ipv6/transport-ikev2/posttest.dat6
-rw-r--r--testing/tests/ipv6/transport-ikev2/pretest.dat10
-rw-r--r--testing/tests/ipv6/transport-ikev2/test.conf10
-rw-r--r--testing/tests/openssl-ikev1/alg-camellia/evaltest.dat2
-rw-r--r--testing/tests/openssl-ikev1/alg-camellia/posttest.dat4
-rw-r--r--testing/tests/openssl-ikev1/alg-camellia/pretest.dat4
-rw-r--r--testing/tests/openssl-ikev1/alg-camellia/test.conf10
-rw-r--r--testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev1/alg-ecp-high/test.conf10
-rw-r--r--testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev1/alg-ecp-low/test.conf10
-rw-r--r--testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev1/ecdsa-certs/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev2/alg-blowfish/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev2/alg-blowfish/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev2/alg-blowfish/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/alg-camellia/evaltest.dat2
-rw-r--r--testing/tests/openssl-ikev2/alg-camellia/posttest.dat4
-rw-r--r--testing/tests/openssl-ikev2/alg-camellia/pretest.dat4
-rw-r--r--testing/tests/openssl-ikev2/alg-camellia/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev2/alg-ecp-high/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev2/alg-ecp-low/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/critical-extension/posttest.dat4
-rw-r--r--testing/tests/openssl-ikev2/critical-extension/pretest.dat4
-rw-r--r--testing/tests/openssl-ikev2/critical-extension/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev2/ecdsa-certs/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/rw-cert/evaltest.dat4
-rw-r--r--testing/tests/openssl-ikev2/rw-cert/posttest.dat6
-rw-r--r--testing/tests/openssl-ikev2/rw-cert/pretest.dat6
-rw-r--r--testing/tests/openssl-ikev2/rw-cert/test.conf10
-rw-r--r--testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat2
-rw-r--r--testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat4
-rw-r--r--testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat4
-rw-r--r--testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf10
-rw-r--r--testing/tests/p2pnat/behind-same-nat/evaltest.dat4
-rwxr-xr-xtesting/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables78
-rw-r--r--testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules28
-rwxr-xr-xtesting/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables77
-rw-r--r--testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules24
-rwxr-xr-xtesting/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables78
-rw-r--r--testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules28
-rw-r--r--testing/tests/p2pnat/behind-same-nat/posttest.dat8
-rw-r--r--testing/tests/p2pnat/behind-same-nat/pretest.dat12
-rw-r--r--testing/tests/p2pnat/behind-same-nat/test.conf10
-rw-r--r--testing/tests/p2pnat/medsrv-psk/evaltest.dat4
-rwxr-xr-xtesting/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables74
-rw-r--r--testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules24
-rw-r--r--testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules24
-rwxr-xr-xtesting/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables77
-rw-r--r--testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules24
-rw-r--r--testing/tests/p2pnat/medsrv-psk/posttest.dat10
-rw-r--r--testing/tests/p2pnat/medsrv-psk/pretest.dat14
-rw-r--r--testing/tests/p2pnat/medsrv-psk/test.conf10
-rw-r--r--testing/tests/pfkey/alg-aes-xcbc/evaltest.dat6
-rw-r--r--testing/tests/pfkey/alg-aes-xcbc/posttest.dat4
-rw-r--r--testing/tests/pfkey/alg-aes-xcbc/pretest.dat4
-rw-r--r--testing/tests/pfkey/alg-aes-xcbc/test.conf10
-rw-r--r--testing/tests/pfkey/alg-sha384/evaltest.dat6
-rw-r--r--testing/tests/pfkey/alg-sha384/posttest.dat4
-rw-r--r--testing/tests/pfkey/alg-sha384/pretest.dat4
-rw-r--r--testing/tests/pfkey/alg-sha384/test.conf10
-rw-r--r--testing/tests/pfkey/alg-sha512/evaltest.dat6
-rw-r--r--testing/tests/pfkey/alg-sha512/posttest.dat4
-rw-r--r--testing/tests/pfkey/alg-sha512/pretest.dat4
-rw-r--r--testing/tests/pfkey/alg-sha512/test.conf10
-rw-r--r--testing/tests/pfkey/esp-alg-null/evaltest.dat2
-rw-r--r--testing/tests/pfkey/esp-alg-null/posttest.dat4
-rw-r--r--testing/tests/pfkey/esp-alg-null/pretest.dat4
-rw-r--r--testing/tests/pfkey/esp-alg-null/test.conf10
-rw-r--r--testing/tests/pfkey/host2host-transport/evaltest.dat2
-rw-r--r--testing/tests/pfkey/host2host-transport/posttest.dat4
-rw-r--r--testing/tests/pfkey/host2host-transport/pretest.dat4
-rw-r--r--testing/tests/pfkey/host2host-transport/test.conf10
-rw-r--r--testing/tests/pfkey/nat-rw/evaltest.dat8
-rw-r--r--testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules24
-rw-r--r--testing/tests/pfkey/nat-rw/posttest.dat6
-rw-r--r--testing/tests/pfkey/nat-rw/pretest.dat7
-rw-r--r--testing/tests/pfkey/nat-rw/test.conf10
-rw-r--r--testing/tests/pfkey/net2net-route/evaltest.dat2
-rw-r--r--testing/tests/pfkey/net2net-route/posttest.dat4
-rw-r--r--testing/tests/pfkey/net2net-route/pretest.dat4
-rw-r--r--testing/tests/pfkey/net2net-route/test.conf10
-rw-r--r--testing/tests/pfkey/protoport-dual/evaltest.dat4
-rw-r--r--testing/tests/pfkey/protoport-dual/posttest.dat4
-rw-r--r--testing/tests/pfkey/protoport-dual/pretest.dat4
-rw-r--r--testing/tests/pfkey/protoport-dual/test.conf10
-rw-r--r--testing/tests/pfkey/protoport-route/evaltest.dat4
-rw-r--r--testing/tests/pfkey/protoport-route/posttest.dat4
-rw-r--r--testing/tests/pfkey/protoport-route/pretest.dat4
-rw-r--r--testing/tests/pfkey/protoport-route/test.conf10
-rw-r--r--testing/tests/pfkey/rw-cert/evaltest.dat4
-rw-r--r--testing/tests/pfkey/rw-cert/posttest.dat6
-rw-r--r--testing/tests/pfkey/rw-cert/pretest.dat6
-rw-r--r--testing/tests/pfkey/rw-cert/test.conf10
-rw-r--r--testing/tests/pfkey/shunt-policies/evaltest.dat20
-rwxr-xr-xtesting/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/pfkey/shunt-policies/posttest.dat4
-rw-r--r--testing/tests/pfkey/shunt-policies/pretest.dat4
-rw-r--r--testing/tests/pfkey/shunt-policies/test.conf10
-rw-r--r--testing/tests/sql/ip-pool-db-expired/evaltest.dat4
-rw-r--r--testing/tests/sql/ip-pool-db-expired/posttest.dat6
-rw-r--r--testing/tests/sql/ip-pool-db-expired/pretest.dat6
-rw-r--r--testing/tests/sql/ip-pool-db-expired/test.conf10
-rw-r--r--testing/tests/sql/ip-pool-db-restart/evaltest.dat4
-rw-r--r--testing/tests/sql/ip-pool-db-restart/posttest.dat6
-rw-r--r--testing/tests/sql/ip-pool-db-restart/pretest.dat6
-rw-r--r--testing/tests/sql/ip-pool-db-restart/test.conf10
-rw-r--r--testing/tests/sql/ip-pool-db/evaltest.dat4
-rw-r--r--testing/tests/sql/ip-pool-db/posttest.dat6
-rw-r--r--testing/tests/sql/ip-pool-db/pretest.dat6
-rw-r--r--testing/tests/sql/ip-pool-db/test.conf10
-rw-r--r--testing/tests/sql/ip-split-pools-db-restart/test.conf10
-rw-r--r--testing/tests/sql/ip-split-pools-db/test.conf10
-rw-r--r--testing/tests/sql/multi-level-ca/evaltest.dat4
-rw-r--r--testing/tests/sql/multi-level-ca/posttest.dat6
-rw-r--r--testing/tests/sql/multi-level-ca/pretest.dat6
-rw-r--r--testing/tests/sql/multi-level-ca/test.conf10
-rw-r--r--testing/tests/sql/net2net-cert/evaltest.dat2
-rw-r--r--testing/tests/sql/net2net-cert/posttest.dat4
-rw-r--r--testing/tests/sql/net2net-cert/pretest.dat4
-rw-r--r--testing/tests/sql/net2net-cert/test.conf10
-rw-r--r--testing/tests/sql/net2net-psk/evaltest.dat2
-rw-r--r--testing/tests/sql/net2net-psk/posttest.dat4
-rw-r--r--testing/tests/sql/net2net-psk/pretest.dat4
-rw-r--r--testing/tests/sql/net2net-psk/test.conf10
-rw-r--r--testing/tests/sql/net2net-route-pem/evaltest.dat4
-rw-r--r--testing/tests/sql/net2net-route-pem/posttest.dat4
-rw-r--r--testing/tests/sql/net2net-route-pem/pretest.dat4
-rw-r--r--testing/tests/sql/net2net-route-pem/test.conf10
-rw-r--r--testing/tests/sql/net2net-start-pem/evaltest.dat4
-rw-r--r--testing/tests/sql/net2net-start-pem/posttest.dat4
-rw-r--r--testing/tests/sql/net2net-start-pem/pretest.dat4
-rw-r--r--testing/tests/sql/net2net-start-pem/test.conf10
-rw-r--r--testing/tests/sql/rw-cert/evaltest.dat4
-rw-r--r--testing/tests/sql/rw-cert/posttest.dat6
-rw-r--r--testing/tests/sql/rw-cert/pretest.dat6
-rw-r--r--testing/tests/sql/rw-cert/test.conf10
-rw-r--r--testing/tests/sql/rw-eap-aka-rsa/evaltest.dat2
-rw-r--r--testing/tests/sql/rw-eap-aka-rsa/posttest.dat4
-rw-r--r--testing/tests/sql/rw-eap-aka-rsa/pretest.dat4
-rw-r--r--testing/tests/sql/rw-eap-aka-rsa/test.conf10
-rw-r--r--testing/tests/sql/rw-psk-ipv4/evaltest.dat4
-rw-r--r--testing/tests/sql/rw-psk-ipv4/posttest.dat6
-rw-r--r--testing/tests/sql/rw-psk-ipv4/pretest.dat6
-rw-r--r--testing/tests/sql/rw-psk-ipv4/test.conf10
-rwxr-xr-xtesting/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables107
-rw-r--r--testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules16
-rwxr-xr-xtesting/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables107
-rw-r--r--testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules16
-rwxr-xr-xtesting/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables107
-rw-r--r--testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules16
-rw-r--r--testing/tests/sql/rw-psk-ipv6/posttest.dat9
-rw-r--r--testing/tests/sql/rw-psk-ipv6/pretest.dat9
-rw-r--r--testing/tests/sql/rw-psk-ipv6/test.conf10
-rw-r--r--testing/tests/sql/rw-psk-rsa-split/evaltest.dat4
-rw-r--r--testing/tests/sql/rw-psk-rsa-split/posttest.dat6
-rw-r--r--testing/tests/sql/rw-psk-rsa-split/pretest.dat6
-rw-r--r--testing/tests/sql/rw-psk-rsa-split/test.conf10
-rw-r--r--testing/tests/sql/rw-rsa-keyid/evaltest.dat4
-rw-r--r--testing/tests/sql/rw-rsa-keyid/posttest.dat6
-rw-r--r--testing/tests/sql/rw-rsa-keyid/pretest.dat6
-rw-r--r--testing/tests/sql/rw-rsa-keyid/test.conf10
-rw-r--r--testing/tests/sql/rw-rsa/evaltest.dat4
-rw-r--r--testing/tests/sql/rw-rsa/posttest.dat6
-rw-r--r--testing/tests/sql/rw-rsa/pretest.dat6
-rw-r--r--testing/tests/sql/rw-rsa/test.conf10
-rw-r--r--testing/tests/sql/shunt-policies/evaltest.dat20
-rwxr-xr-xtesting/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/sql/shunt-policies/posttest.dat4
-rw-r--r--testing/tests/sql/shunt-policies/pretest.dat4
-rw-r--r--testing/tests/sql/shunt-policies/test.conf10
-rw-r--r--testing/tests/tnc/tnccs-11-fhh/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-11-fhh/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-11-fhh/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-11-fhh/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/evaltest.dat4
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/eap.conf)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default43
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel (renamed from testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second (renamed from testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel-second)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/users (renamed from testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary2
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc5
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf120
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default44
-rwxr-xr-xtesting/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/posttest.dat8
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/pretest.dat10
-rw-r--r--testing/tests/tnc/tnccs-11-radius-block/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-11-radius/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/eap.conf (renamed from testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/eap.conf)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/proxy.conf (renamed from testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/proxy.conf)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default43
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel (renamed from testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second (renamed from testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel-second)6
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/users (renamed from testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/users)0
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf4
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary2
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc5
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf120
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default44
-rwxr-xr-xtesting/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/tnc/tnccs-11-radius/posttest.dat8
-rw-r--r--testing/tests/tnc/tnccs-11-radius/pretest.dat10
-rw-r--r--testing/tests/tnc/tnccs-11-radius/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-11/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-11/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-11/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-11/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-20-block/evaltest.dat4
-rw-r--r--testing/tests/tnc/tnccs-20-block/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-block/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-block/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-20-client-retry/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-20-client-retry/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-client-retry/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-client-retry/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-20-fhh/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-20-fhh/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-fhh/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-fhh/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-20-os/description.txt23
-rw-r--r--testing/tests/tnc/tnccs-20-os/evaltest.dat19
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.conf23
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.secrets3
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/carol/etc/strongswan.conf19
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/carol/etc/tnc_config3
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.conf23
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.secrets3
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/dave/etc/strongswan.conf26
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/dave/etc/tnc_config3
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.conf34
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.secrets6
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/moon/etc/strongswan.conf24
-rw-r--r--testing/tests/tnc/tnccs-20-os/hosts/moon/etc/tnc_config3
-rw-r--r--testing/tests/tnc/tnccs-20-os/posttest.dat7
-rw-r--r--testing/tests/tnc/tnccs-20-os/pretest.dat14
-rw-r--r--testing/tests/tnc/tnccs-20-os/test.conf26
-rw-r--r--testing/tests/tnc/tnccs-20-pdp/evaltest.dat12
-rwxr-xr-xtesting/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables84
-rw-r--r--testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules32
-rw-r--r--testing/tests/tnc/tnccs-20-pdp/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-pdp/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-pdp/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-20-server-retry/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-20-server-retry/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-server-retry/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-server-retry/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-20-tls/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-20-tls/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-tls/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20-tls/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-20/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf2
-rw-r--r--testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf2
-rw-r--r--testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf2
-rw-r--r--testing/tests/tnc/tnccs-20/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-20/test.conf12
-rw-r--r--testing/tests/tnc/tnccs-dynamic/evaltest.dat12
-rw-r--r--testing/tests/tnc/tnccs-dynamic/posttest.dat6
-rw-r--r--testing/tests/tnc/tnccs-dynamic/pretest.dat6
-rw-r--r--testing/tests/tnc/tnccs-dynamic/test.conf12
1422 files changed, 18757 insertions, 40922 deletions
diff --git a/testing/INSTALL b/testing/INSTALL
deleted file mode 100644
index bb4272eaf..000000000
--- a/testing/INSTALL
+++ /dev/null
@@ -1,145 +0,0 @@
-
- -------------------------------
- strongSwan UML - Installation
- -------------------------------
-
-
-Contents
---------
-
- 1. Making the host system UML-capable
- 2. Installing the required files
- 3. Creating the UML testing environment
-
-
-1. Making the host system UML-capable
- ----------------------------------
-
- UML instances can be run on both Linux 2.4 and Linux 2.6 kernels.
- If you are using a vanilla kernel from kernel.org then you must first
- apply the host SKAS patch available from
-
- http://www.user-mode-linux.org/~blaisorblade/patches/
-
- and recompile and reboot your host kernel. Some Linux distributions as e.g.
- SuSE already include the SKAS patch in their kernels.
-
- You will also need the UML utilities (uml_mconsole and uml_switch)
- available from
-
- http://prdownloads.sourceforge.net/user-mode-linux/uml_utilities_20040406.tar.bz2
-
- Many Linux distributions offer the UML utilities as a package.
-
-
-2. Installing the required files
- -----------------------------
-
-First create a directory where you want the strongSwan UML testing environment
-to be located.The default directory is "~/strongswan-testing". If you choose a
-different location, please adapt the UMLTESTDIR variable in "testing.conf"
-accordingly.
-
- mkdir ~/strongswan-testing
-
-Now copy the "testing" subdirectory coming with the strongSwan distribution to
-the UML testing environment:
-
- cp -r testing ~/strongswan-testing
-
-Next you need to copy several files into the ~/strongswan-testing directory that
-are required for the strongSwan testing environment:
-
- * A vanilla Linux kernel on which the UML kernel will be based on.
- We recommend the use of
-
- http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.36.tar.bz2
-
- * The Linux kernel 2.6.36 does not require any patches for the uml guest kernel
- to successfully start up.
-
- * The matching .config file required to compile the UML kernel:
-
- http://download.strongswan.org/uml/.config-2.6.36
-
- * A gentoo-based UML file system (compressed size 130 MBytes) found at
-
- http://download.strongswan.org/uml/gentoo-fs-20100830.tar.bz2
-
- * The latest strongSwan distribution
-
- http://download.strongswan.org/strongswan-4.5.1.tar.bz2
-
-
-3. Creating the environment
- ------------------------
-
-Now change into the testing subdirectory
-
- cd ~/strongswan-testing/testing
-
-and make the UML testing environment:
-
- ./make-testing <hosts>
-
-The "make-testing" script calls a series of subscripts which can be
-enabled or disabled individually by setting the corresponding flags
-in "testing.conf":
-
- if [ $ENABLE_BUILD_UMLKERNEL = "yes" ]
- then
- scripts/build-umlkernel
- fi
-
-builds an UML kernel out of the vanilla Linux kernel and the corresponding
-UML kernel patch.
-
- if [ $ENABLE_BUILD_HOSTCONFIG = "yes" ]
- then
- scripts/build-hostconfig
- fi
-
-generates the default configurations for the UML hosts alice, venus, moon,
-carol, winnetou, dave, sun, and bob by replacing the wildcards PH_IP_ALICE,
-etc. by the actual IP addresses defined in "testing.conf".
-
- if [ $ENABLE_BUILD_UMLROOTFS = "yes" ]
- then
- scripts/build-umlrootfs
- fi
-
-takes the gentoo-based UML file system and compiles the latest strongSwan
-distribution into it.
-
- if [ $ENABLE_BUILD_SSHKEYS = "yes" ]
- then
- scripts/build-sshkeys
- fi
-
-adds the common RSA public key of the UML instances to your ~/.ssh/known_hosts
-directory so that you can log onto the UML instances using ssh without typing
-in a password. The "scripts/build-sshkeys" script should only be run once.
-
- if [ $ENABLE_BUILD_UMLHOSTFS = "yes" ]
- then
- scripts/build-umlhostfs <hosts>
- fi
-
-creates the customized UML file systems for the instances given as command line
-arguments by adding the default host configurations to the UML root file system.
-If the "make-starting" scripts is called without any arguments then by default
-the UML file systems are created for the hosts alice, venus, moon, carol,
-winnetou, dave, sun, and bob. Each UML root file system has as size defined by
-the ROOTFSSIZE in testing.conf which by default is 544 MBytes. Thus all 8 UML
-hosts plus the master copy will require a total of 5 GBytes of disk space.
-
- if [ $ENABLE_START_TESTING = "yes" ]
- then
- ./start-testing <hosts>
- fi
-
-starts the automated testing. More details on the tests you'll find in the
-README document.
-
------------------------------------------------------------------------------
-
diff --git a/testing/Makefile.am b/testing/Makefile.am
index 2aa7d70bc..305bf7f72 100644
--- a/testing/Makefile.am
+++ b/testing/Makefile.am
@@ -1,11 +1,4 @@
-noinst_SCRIPTS = do-tests
-CLEANFILES = do-tests
-EXTRA_DIST = do-tests.in make-testing start-testing stop-testing \
- testing.conf ssh_config hosts images scripts tests INSTALL README
-
-do-tests : do-tests.in
- sed \
- -e "s:\@routing_table\@:$(routing_table):" \
- $(srcdir)/$@.in > $@
- chmod +x $@
+EXTRA_DIST = do-tests make-testing start-testing stop-testing \
+ testing.conf ssh_config config hosts images scripts tests \
+ README
diff --git a/testing/Makefile.in b/testing/Makefile.in
index d37e9ec73..0f7ada07d 100644
--- a/testing/Makefile.in
+++ b/testing/Makefile.in
@@ -1,9 +1,9 @@
-# Makefile.in generated by automake 1.11.1 from Makefile.am.
+# Makefile.in generated by automake 1.11.3 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
-# Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software
+# Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -14,7 +14,6 @@
# PARTICULAR PURPOSE.
@SET_MAKE@
-
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
@@ -35,8 +34,7 @@ POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = testing
-DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in \
- INSTALL
+DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
$(top_srcdir)/m4/config/ltoptions.m4 \
@@ -53,7 +51,6 @@ mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES =
CONFIG_CLEAN_VPATH_FILES =
-SCRIPTS = $(noinst_SCRIPTS)
SOURCES =
DIST_SOURCES =
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -76,6 +73,7 @@ CYGPATH_W = @CYGPATH_W@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DLLIB = @DLLIB@
+DLLTOOL = @DLLTOOL@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
ECHO_C = @ECHO_C@
@@ -103,6 +101,7 @@ LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
MYSQLCFLAG = @MYSQLCFLAG@
MYSQLCONFIG = @MYSQLCONFIG@
@@ -130,6 +129,7 @@ RANLIB = @RANLIB@
RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
+RUBYLIB = @RUBYLIB@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
@@ -142,6 +142,7 @@ abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
@@ -195,7 +196,6 @@ libexecdir = @libexecdir@
linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
-lt_ECHO = @lt_ECHO@
maemo_CFLAGS = @maemo_CFLAGS@
maemo_LIBS = @maemo_LIBS@
manager_plugins = @manager_plugins@
@@ -242,10 +242,9 @@ top_srcdir = @top_srcdir@
urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
-noinst_SCRIPTS = do-tests
-CLEANFILES = do-tests
-EXTRA_DIST = do-tests.in make-testing start-testing stop-testing \
- testing.conf ssh_config hosts images scripts tests INSTALL README
+EXTRA_DIST = do-tests make-testing start-testing stop-testing \
+ testing.conf ssh_config config hosts images scripts tests \
+ README
all: all-am
@@ -325,7 +324,7 @@ distdir: $(DISTFILES)
done
check-am: all-am
check: check-am
-all-am: Makefile $(SCRIPTS)
+all-am: Makefile
installdirs:
install: install-am
install-exec: install-exec-am
@@ -337,14 +336,18 @@ install-am: all-am
installcheck: installcheck-am
install-strip:
- $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
- install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
- `test -z '$(STRIP)' || \
- echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
+ if test -z '$(STRIP)'; then \
+ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+ install; \
+ else \
+ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+ fi
mostlyclean-generic:
clean-generic:
- -test -z "$(CLEANFILES)" || rm -f $(CLEANFILES)
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
@@ -433,12 +436,6 @@ uninstall-am:
mostlyclean-libtool pdf pdf-am ps ps-am uninstall uninstall-am
-do-tests : do-tests.in
- sed \
- -e "s:\@routing_table\@:$(routing_table):" \
- $(srcdir)/$@.in > $@
- chmod +x $@
-
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/testing/README b/testing/README
index 097b4264d..a62497269 100644
--- a/testing/README
+++ b/testing/README
@@ -1,158 +1,88 @@
- ------------------------------------
- strongSwan UML - Running the Tests
- ------------------------------------
+ ------------------------------
+ strongSwan Integration Tests
+ ------------------------------
Contents
--------
- 1. Starting up the UML testing environment
- 2. Running the automated tests
- 3. Manual testing
+ 1. Building the testing environment
+ 2. Starting up the testing environment
+ 3. Running the automated tests
+ 4. Manual testing
-1. Starting up the UML testing environment
- ---------------------------------------
-
-When the strongSwan UML testing environment has been put into place by
-running the "make-testing" script then you are ready to start up the
-UML instances by calling
+1. Building the testing environment
+ --------------------------------
- ./start-testing <hosts>
-
-This main script first calls the subscript
+The testing environment can be built with the "make-testing" script after
+adjusting the variables in the testing.conf file. By default everything is
+built when executing the script. Setting any of the ENABLE_BUILD_* variables
+in the configuration file to "no" will not build those parts.
- scripts/start-switches
-that starts the three UML switches umlswitch0, umlswitch1, and umlswitch2
-which are connecting the UML instances among each other and via tun/tap
-devices also make them accessible from the host system.
-
-Then depending on the setting of the UMLSTARTMODE variable defined
-in "testing.conf", the UML instances given on the command line are started
-up with different terminals:
+2. Starting up the testing environment
+ -----------------------------------
-If you are running the KDE graphical environment then by setting
+When the strongSwan testing environment has been put into place by running
+the "make-testing" script you are ready to start up the KVM instances by
+executing the "start-testing" script.
- UMLSTARTMODE=konsole
-
-the script
- scripts/kstart-umls <hosts>
-
-is called which starts up each of the UML instances defined by <hosts> in
-a KDE konsole. If
-
- UMLSTARTMODE=xterm
-
-is set then
-
- scripts/xstart-umls <hosts>
-
-starts up the UML instances in an xterm each. And with the choice
-
- UMLSTARTMODE=screen
-
-the instances are started up by
-
- scripts/start-umls <hosts>
-
-in the background but the Linux command "screen -r <host>" can be used to
-connect a terminal to the UML instance <host> if desired.
-
-
- if [ $ENABLE_DO_TESTS = "yes" ]
- then
- do-tests
- fi
-
-either executes all the tests defined in the "testing/tests" directory
-if the variable SELECTEDTESTSONLY in "testing.conf" is set to "no" or the
-selected tests defined by the string in SELELECTEDTESTS if SELECTEDTESTSONLY
-is set to "yes".
-
- if [ $ENABLE_STOP_TESTING = "yes" ]
- then
- stop-testing <hosts>
- fi
-
-stops the both the UML switches and the UML instances designated by the
-<hosts> argument.
-
-
-2. Running the automated tests
+3. Running the automated tests
---------------------------
The script
./do-tests <testnames>
-runs the automated tests. With an empty <testnames> argument the tests
-as defined in "testing.conf" are executed, otherwise the tests enumerated
-by the <testnames> argument will be run as shown in the example below.
+runs the automated tests. If the <testnames> argument is omitted all tests
+are executed, otherwise only the tests listed will be run as shown in the
+example below:
- ./do-tests net2net-psk net2net-cert
+ ./do-tests ikev2/net2net-psk ikev2/net2net-cert
Each test is divided into the following phases:
- * scripts/load-testconfig <testname>
- loads the UML hosts with test specific settings if such are provided.
-
- * next the "pretest.dat" script found in each test directory is executed.
- Among other commands, strongSwan is started on the IPsec hosts.
+ * Load the test-specific guest configuration if any is provided.
- * the "evaltest.dat" script evaluates if the test has been successful.
-
- * the "posttest.dat" script terminates the test e.g. by stopping
- strongSwan on the IPsec hosts.
+ * Next the "pretest.dat" script found in each test directory is executed.
+ Among other commands, strongSwan is started on the IPsec hosts.
- * scripts/restore-defaults <testname>
- restores the default settings on the UML hosts.
+ * The "evaltest.dat" script evaluates if the test has been successful.
-The test results and configuration settings for all tests settings are stored
-in a folder labeled with the current date in the directory
-
- ~/strongswan-testing/testresults
-
-the same results are also automatically transferred to the Apache server
-running on UML instance "winnetou" and can be accessed via the URL
+ * The "posttest.dat" script terminates the test e.g. by stopping
+ strongSwan on the IPsec hosts. It is also responsible to cleaning up
+ things (e.g. firewall rules) set up in "pretest.dat".
- http://192.168.0.150/testresults/
+ * Restore the default configuration on every host (new files have to be
+ deleted manually in "posttest.dat").
+The test results and configuration files for all tests are stored in a
+folder labeled with the current date and time in the $TESTRESULTSDIR directory.
-3. Manual testing
- --------------
-
-The greates flexibility can be achieved with manual testing. Just set
-
- ENABLE_DO_TESTS="no"
- ENABLE_STOP_TESTING="no"
-
-in "testing.conf" and start the UML instances that you want to experiment with
-by calling
+The same results are also automatically transferred to the Apache server
+running on guest "winnetou" and can be accessed via the URL
- ./start-testing <hosts>
-
-If you want to preload a test scenario with configurations differing from
-the default values, e.g. when using Preshared Keys then you can do this
-with the command
+ http://192.168.0.150/testresults/
- scripts/load-testconfig net2net-psk
-
-You can then log onto any UML instance using its konsole, xterm or screen
-terminal as root with the default password
- tuxmux
-
-You can then execute any commands the UML instances, including changing
-and recompiling the strongSwan source code located in the /root directory.
+4. Manual testing
+ --------------
-After you have finished testing, the default configuration settings can
-restored with the command
+Instead of running tests automatically with "do-tests" it is possible to
+preload a test scenario with the script:
- scripts/restore-defaults net2net-psk
+ scripts/load-testconfig <testname>
+Individual configuration files can be changed and any command can be executed by
+logging into a guest host directly (via SSH or a console window). No password
+is required to login as root. The sources for every software built during
+"make-testing" are mounted at /root/shared/, which allows you to change and
+recompile these components.
------------------------------------------------------------------------------
+After you have finished testing, the default configuration can be restored
+with the following command (newly created files have to be deleted manually)
+ scripts/restore-defaults
diff --git a/testing/config/kernel/config-3.5 b/testing/config/kernel/config-3.5
new file mode 100644
index 000000000..9494331eb
--- /dev/null
+++ b/testing/config/kernel/config-3.5
@@ -0,0 +1,1817 @@
+#
+# Automatically generated file; DO NOT EDIT.
+# Linux/x86_64 3.5.3 Kernel Configuration
+#
+CONFIG_64BIT=y
+# CONFIG_X86_32 is not set
+CONFIG_X86_64=y
+CONFIG_X86=y
+CONFIG_INSTRUCTION_DECODER=y
+CONFIG_OUTPUT_FORMAT="elf64-x86-64"
+CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig"
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_HAVE_LATENCYTOP_SUPPORT=y
+CONFIG_MMU=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+# CONFIG_RWSEM_GENERIC_SPINLOCK is not set
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_ARCH_HAS_CPU_RELAX=y
+CONFIG_ARCH_HAS_DEFAULT_IDLE=y
+CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
+CONFIG_ARCH_HAS_CPU_AUTOPROBE=y
+CONFIG_HAVE_SETUP_PER_CPU_AREA=y
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
+CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ZONE_DMA32=y
+CONFIG_AUDIT_ARCH=y
+CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y
+CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
+CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11"
+CONFIG_ARCH_SUPPORTS_UPROBES=y
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_HAVE_IRQ_WORK=y
+CONFIG_IRQ_WORK=y
+CONFIG_BUILDTIME_EXTABLE_SORT=y
+
+#
+# General setup
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_BROKEN_ON_SMP=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_CROSS_COMPILE=""
+CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION_AUTO=y
+CONFIG_HAVE_KERNEL_GZIP=y
+CONFIG_HAVE_KERNEL_BZIP2=y
+CONFIG_HAVE_KERNEL_LZMA=y
+CONFIG_HAVE_KERNEL_XZ=y
+CONFIG_HAVE_KERNEL_LZO=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_BZIP2 is not set
+# CONFIG_KERNEL_LZMA is not set
+# CONFIG_KERNEL_XZ is not set
+# CONFIG_KERNEL_LZO is not set
+CONFIG_DEFAULT_HOSTNAME="(none)"
+CONFIG_SWAP=y
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_BSD_PROCESS_ACCT=y
+# CONFIG_BSD_PROCESS_ACCT_V3 is not set
+# CONFIG_FHANDLE is not set
+# CONFIG_TASKSTATS is not set
+# CONFIG_AUDIT is not set
+CONFIG_HAVE_GENERIC_HARDIRQS=y
+
+#
+# IRQ subsystem
+#
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_ARCH_CLOCKSOURCE_DATA=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+
+#
+# Timers subsystem
+#
+CONFIG_TICK_ONESHOT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+
+#
+# RCU Subsystem
+#
+CONFIG_TINY_RCU=y
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
+# CONFIG_CGROUPS is not set
+# CONFIG_CHECKPOINT_RESTORE is not set
+CONFIG_NAMESPACES=y
+# CONFIG_UTS_NS is not set
+# CONFIG_IPC_NS is not set
+# CONFIG_PID_NS is not set
+# CONFIG_NET_NS is not set
+# CONFIG_SCHED_AUTOGROUP is not set
+# CONFIG_SYSFS_DEPRECATED is not set
+# CONFIG_RELAY is not set
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SYSCTL=y
+CONFIG_ANON_INODES=y
+# CONFIG_EXPERT is not set
+# CONFIG_SYSCTL_SYSCALL is not set
+CONFIG_KALLSYMS=y
+# CONFIG_KALLSYMS_ALL is not set
+CONFIG_HOTPLUG=y
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
+CONFIG_PCSPKR_PLATFORM=y
+CONFIG_HAVE_PCSPKR_PLATFORM=y
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
+CONFIG_EPOLL=y
+CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
+CONFIG_EVENTFD=y
+CONFIG_SHMEM=y
+CONFIG_AIO=y
+# CONFIG_EMBEDDED is not set
+CONFIG_HAVE_PERF_EVENTS=y
+
+#
+# Kernel Performance Events And Counters
+#
+CONFIG_PERF_EVENTS=y
+# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_PCI_QUIRKS=y
+CONFIG_COMPAT_BRK=y
+CONFIG_SLAB=y
+# CONFIG_SLUB is not set
+# CONFIG_PROFILING is not set
+CONFIG_HAVE_OPROFILE=y
+CONFIG_OPROFILE_NMI_TIMER=y
+# CONFIG_JUMP_LABEL is not set
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
+CONFIG_HAVE_IOREMAP_PROT=y
+CONFIG_HAVE_KPROBES=y
+CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_OPTPROBES=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_HW_BREAKPOINT=y
+CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y
+CONFIG_HAVE_USER_RETURN_NOTIFIER=y
+CONFIG_HAVE_PERF_EVENTS_NMI=y
+CONFIG_HAVE_ARCH_JUMP_LABEL=y
+CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
+CONFIG_HAVE_CMPXCHG_LOCAL=y
+CONFIG_HAVE_CMPXCHG_DOUBLE=y
+CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
+CONFIG_SECCOMP_FILTER=y
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
+CONFIG_SLABINFO=y
+CONFIG_RT_MUTEXES=y
+CONFIG_BASE_SMALL=0
+# CONFIG_MODULES is not set
+CONFIG_BLOCK=y
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_BLK_DEV_BSGLIB is not set
+# CONFIG_BLK_DEV_INTEGRITY is not set
+
+#
+# Partition Types
+#
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_MSDOS_PARTITION=y
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_DEFAULT_DEADLINE is not set
+CONFIG_DEFAULT_CFQ=y
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+# CONFIG_INLINE_SPIN_TRYLOCK is not set
+# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK is not set
+# CONFIG_INLINE_SPIN_LOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
+# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
+CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_READ_TRYLOCK is not set
+# CONFIG_INLINE_READ_LOCK is not set
+# CONFIG_INLINE_READ_LOCK_BH is not set
+# CONFIG_INLINE_READ_LOCK_IRQ is not set
+# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
+CONFIG_INLINE_READ_UNLOCK=y
+# CONFIG_INLINE_READ_UNLOCK_BH is not set
+CONFIG_INLINE_READ_UNLOCK_IRQ=y
+# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_WRITE_TRYLOCK is not set
+# CONFIG_INLINE_WRITE_LOCK is not set
+# CONFIG_INLINE_WRITE_LOCK_BH is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
+CONFIG_INLINE_WRITE_UNLOCK=y
+# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
+CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
+# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
+# CONFIG_MUTEX_SPIN_ON_OWNER is not set
+CONFIG_FREEZER=y
+
+#
+# Processor type and features
+#
+CONFIG_ZONE_DMA=y
+# CONFIG_SMP is not set
+CONFIG_X86_MPPARSE=y
+CONFIG_X86_EXTENDED_PLATFORM=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
+CONFIG_PARAVIRT_GUEST=y
+# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
+# CONFIG_XEN is not set
+# CONFIG_XEN_PRIVILEGED_GUEST is not set
+CONFIG_KVM_CLOCK=y
+CONFIG_KVM_GUEST=y
+CONFIG_PARAVIRT=y
+CONFIG_PARAVIRT_CLOCK=y
+# CONFIG_PARAVIRT_DEBUG is not set
+CONFIG_NO_BOOTMEM=y
+# CONFIG_MEMTEST is not set
+# CONFIG_MK8 is not set
+# CONFIG_MPSC is not set
+CONFIG_MCORE2=y
+# CONFIG_MATOM is not set
+# CONFIG_GENERIC_CPU is not set
+CONFIG_X86_INTERNODE_CACHE_SHIFT=6
+CONFIG_X86_CMPXCHG=y
+CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_XADD=y
+CONFIG_X86_WP_WORKS_OK=y
+CONFIG_X86_INTEL_USERCOPY=y
+CONFIG_X86_USE_PPRO_CHECKSUM=y
+CONFIG_X86_P6_NOP=y
+CONFIG_X86_TSC=y
+CONFIG_X86_CMPXCHG64=y
+CONFIG_X86_CMOV=y
+CONFIG_X86_MINIMUM_CPU_FAMILY=64
+CONFIG_X86_DEBUGCTLMSR=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR=y
+CONFIG_HPET_TIMER=y
+CONFIG_DMI=y
+CONFIG_GART_IOMMU=y
+# CONFIG_CALGARY_IOMMU is not set
+CONFIG_SWIOTLB=y
+CONFIG_IOMMU_HELPER=y
+CONFIG_NR_CPUS=1
+# CONFIG_IRQ_TIME_ACCOUNTING is not set
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT is not set
+CONFIG_X86_LOCAL_APIC=y
+CONFIG_X86_IO_APIC=y
+# CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set
+# CONFIG_X86_MCE is not set
+# CONFIG_I8K is not set
+# CONFIG_MICROCODE is not set
+# CONFIG_X86_MSR is not set
+# CONFIG_X86_CPUID is not set
+CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_DIRECT_GBPAGES=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_MEMORY_PROBE=y
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_SPARSEMEM_MANUAL=y
+CONFIG_SPARSEMEM=y
+CONFIG_HAVE_MEMORY_PRESENT=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_HAVE_MEMBLOCK=y
+CONFIG_HAVE_MEMBLOCK_NODE_MAP=y
+CONFIG_ARCH_DISCARD_MEMBLOCK=y
+CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTPLUG_SPARSE=y
+CONFIG_MEMORY_HOTREMOVE=y
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_COMPACTION is not set
+CONFIG_MIGRATION=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_ZONE_DMA_FLAG=1
+CONFIG_BOUNCE=y
+CONFIG_VIRT_TO_BUS=y
+# CONFIG_KSM is not set
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
+# CONFIG_TRANSPARENT_HUGEPAGE is not set
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_NEED_PER_CPU_KM=y
+# CONFIG_CLEANCACHE is not set
+# CONFIG_FRONTSWAP is not set
+# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set
+CONFIG_X86_RESERVE_LOW=64
+CONFIG_MTRR=y
+CONFIG_MTRR_SANITIZER=y
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
+CONFIG_X86_PAT=y
+CONFIG_ARCH_USES_PG_UNCACHED=y
+CONFIG_ARCH_RANDOM=y
+# CONFIG_EFI is not set
+CONFIG_SECCOMP=y
+# CONFIG_CC_STACKPROTECTOR is not set
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=250
+CONFIG_SCHED_HRTICK=y
+# CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
+CONFIG_PHYSICAL_START=0x1000000
+CONFIG_RELOCATABLE=y
+CONFIG_PHYSICAL_ALIGN=0x1000000
+# CONFIG_CMDLINE_BOOL is not set
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
+CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
+
+#
+# Power management and ACPI options
+#
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+# CONFIG_HIBERNATION is not set
+CONFIG_PM_SLEEP=y
+# CONFIG_PM_AUTOSLEEP is not set
+# CONFIG_PM_WAKELOCKS is not set
+# CONFIG_PM_RUNTIME is not set
+CONFIG_PM=y
+# CONFIG_PM_DEBUG is not set
+CONFIG_ACPI=y
+CONFIG_ACPI_SLEEP=y
+# CONFIG_ACPI_PROCFS is not set
+# CONFIG_ACPI_PROCFS_POWER is not set
+# CONFIG_ACPI_EC_DEBUGFS is not set
+CONFIG_ACPI_PROC_EVENT=y
+CONFIG_ACPI_AC=y
+CONFIG_ACPI_BATTERY=y
+CONFIG_ACPI_BUTTON=y
+CONFIG_ACPI_FAN=y
+# CONFIG_ACPI_DOCK is not set
+CONFIG_ACPI_PROCESSOR=y
+# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
+CONFIG_ACPI_THERMAL=y
+# CONFIG_ACPI_CUSTOM_DSDT is not set
+CONFIG_ACPI_BLACKLIST_YEAR=0
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_PCI_SLOT is not set
+CONFIG_X86_PM_TIMER=y
+# CONFIG_ACPI_CONTAINER is not set
+# CONFIG_ACPI_HOTPLUG_MEMORY is not set
+# CONFIG_ACPI_SBS is not set
+# CONFIG_ACPI_HED is not set
+# CONFIG_ACPI_BGRT is not set
+# CONFIG_ACPI_APEI is not set
+# CONFIG_SFI is not set
+
+#
+# CPU Frequency scaling
+#
+# CONFIG_CPU_FREQ is not set
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+# CONFIG_INTEL_IDLE is not set
+
+#
+# Memory power savings
+#
+# CONFIG_I7300_IDLE is not set
+
+#
+# Bus options (PCI etc.)
+#
+CONFIG_PCI=y
+CONFIG_PCI_DIRECT=y
+# CONFIG_PCI_MMCONFIG is not set
+CONFIG_PCI_DOMAINS=y
+# CONFIG_PCI_CNB20LE_QUIRK is not set
+# CONFIG_PCIEPORTBUS is not set
+CONFIG_ARCH_SUPPORTS_MSI=y
+CONFIG_PCI_MSI=y
+# CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set
+# CONFIG_PCI_STUB is not set
+CONFIG_HT_IRQ=y
+# CONFIG_PCI_IOV is not set
+# CONFIG_PCI_PRI is not set
+# CONFIG_PCI_PASID is not set
+# CONFIG_PCI_IOAPIC is not set
+CONFIG_PCI_LABEL=y
+CONFIG_ISA_DMA_API=y
+CONFIG_AMD_NB=y
+# CONFIG_PCCARD is not set
+# CONFIG_HOTPLUG_PCI is not set
+# CONFIG_RAPIDIO is not set
+
+#
+# Executable file formats / Emulations
+#
+CONFIG_BINFMT_ELF=y
+CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_HAVE_AOUT is not set
+# CONFIG_BINFMT_MISC is not set
+# CONFIG_IA32_EMULATION is not set
+# CONFIG_COMPAT_FOR_U64_ALIGNMENT is not set
+CONFIG_HAVE_TEXT_POKE_SMP=y
+CONFIG_X86_DEV_DMA_OPS=y
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+# CONFIG_UNIX_DIAG is not set
+CONFIG_XFRM=y
+CONFIG_XFRM_ALGO=y
+CONFIG_XFRM_USER=y
+CONFIG_XFRM_SUB_POLICY=y
+CONFIG_XFRM_MIGRATE=y
+CONFIG_XFRM_STATISTICS=y
+CONFIG_XFRM_IPCOMP=y
+CONFIG_NET_KEY=y
+CONFIG_NET_KEY_MIGRATE=y
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+CONFIG_IP_ADVANCED_ROUTER=y
+# CONFIG_IP_FIB_TRIE_STATS is not set
+CONFIG_IP_MULTIPLE_TABLES=y
+# CONFIG_IP_ROUTE_MULTIPATH is not set
+# CONFIG_IP_ROUTE_VERBOSE is not set
+CONFIG_IP_ROUTE_CLASSID=y
+# CONFIG_IP_PNP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE_DEMUX is not set
+# CONFIG_ARPD is not set
+# CONFIG_SYN_COOKIES is not set
+CONFIG_INET_AH=y
+CONFIG_INET_ESP=y
+CONFIG_INET_IPCOMP=y
+CONFIG_INET_XFRM_TUNNEL=y
+CONFIG_INET_TUNNEL=y
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
+# CONFIG_INET_LRO is not set
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_INET_UDP_DIAG is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
+CONFIG_IPV6=y
+# CONFIG_IPV6_PRIVACY is not set
+# CONFIG_IPV6_ROUTER_PREF is not set
+CONFIG_IPV6_OPTIMISTIC_DAD=y
+CONFIG_INET6_AH=y
+CONFIG_INET6_ESP=y
+CONFIG_INET6_IPCOMP=y
+CONFIG_IPV6_MIP6=y
+CONFIG_INET6_XFRM_TUNNEL=y
+CONFIG_INET6_TUNNEL=y
+CONFIG_INET6_XFRM_MODE_TRANSPORT=y
+CONFIG_INET6_XFRM_MODE_TUNNEL=y
+CONFIG_INET6_XFRM_MODE_BEET=y
+# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+# CONFIG_IPV6_SIT is not set
+# CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+# CONFIG_IPV6_MROUTE is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_DEBUG is not set
+CONFIG_NETFILTER_ADVANCED=y
+
+#
+# Core Netfilter Configuration
+#
+CONFIG_NETFILTER_NETLINK=y
+# CONFIG_NETFILTER_NETLINK_ACCT is not set
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_PROCFS=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+# CONFIG_NF_CONNTRACK_TIMEOUT is not set
+# CONFIG_NF_CONNTRACK_TIMESTAMP is not set
+# CONFIG_NF_CT_PROTO_DCCP is not set
+# CONFIG_NF_CT_PROTO_SCTP is not set
+CONFIG_NF_CT_PROTO_UDPLITE=y
+# CONFIG_NF_CONNTRACK_AMANDA is not set
+# CONFIG_NF_CONNTRACK_FTP is not set
+# CONFIG_NF_CONNTRACK_H323 is not set
+# CONFIG_NF_CONNTRACK_IRC is not set
+# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set
+# CONFIG_NF_CONNTRACK_SNMP is not set
+# CONFIG_NF_CONNTRACK_PPTP is not set
+CONFIG_NF_CONNTRACK_SANE=y
+# CONFIG_NF_CONNTRACK_SIP is not set
+# CONFIG_NF_CONNTRACK_TFTP is not set
+CONFIG_NF_CT_NETLINK=y
+# CONFIG_NF_CT_NETLINK_TIMEOUT is not set
+# CONFIG_NETFILTER_TPROXY is not set
+CONFIG_NETFILTER_XTABLES=y
+
+#
+# Xtables combined modules
+#
+CONFIG_NETFILTER_XT_MARK=y
+CONFIG_NETFILTER_XT_CONNMARK=y
+CONFIG_NETFILTER_XT_SET=y
+
+#
+# Xtables targets
+#
+# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+# CONFIG_NETFILTER_XT_TARGET_CT is not set
+CONFIG_NETFILTER_XT_TARGET_DSCP=y
+CONFIG_NETFILTER_XT_TARGET_HL=y
+# CONFIG_NETFILTER_XT_TARGET_HMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set
+CONFIG_NETFILTER_XT_TARGET_LOG=y
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
+# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
+# CONFIG_NETFILTER_XT_TARGET_TEE is not set
+CONFIG_NETFILTER_XT_TARGET_TRACE=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
+
+#
+# Xtables matches
+#
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=y
+CONFIG_NETFILTER_XT_MATCH_COMMENT=y
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+# CONFIG_NETFILTER_XT_MATCH_CPU is not set
+CONFIG_NETFILTER_XT_MATCH_DCCP=y
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y
+CONFIG_NETFILTER_XT_MATCH_DSCP=y
+CONFIG_NETFILTER_XT_MATCH_ECN=y
+CONFIG_NETFILTER_XT_MATCH_ESP=y
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_HL=y
+# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set
+CONFIG_NETFILTER_XT_MATCH_LENGTH=y
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
+CONFIG_NETFILTER_XT_MATCH_MAC=y
+CONFIG_NETFILTER_XT_MATCH_MARK=y
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
+# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
+# CONFIG_NETFILTER_XT_MATCH_OSF is not set
+# CONFIG_NETFILTER_XT_MATCH_OWNER is not set
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA=y
+# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set
+CONFIG_NETFILTER_XT_MATCH_REALM=y
+# CONFIG_NETFILTER_XT_MATCH_RECENT is not set
+CONFIG_NETFILTER_XT_MATCH_SCTP=y
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
+CONFIG_NETFILTER_XT_MATCH_STRING=y
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=y
+# CONFIG_NETFILTER_XT_MATCH_TIME is not set
+CONFIG_NETFILTER_XT_MATCH_U32=y
+CONFIG_IP_SET=y
+CONFIG_IP_SET_MAX=256
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+# CONFIG_IP_SET_HASH_NETIFACE is not set
+CONFIG_IP_SET_LIST_SET=y
+# CONFIG_IP_VS is not set
+
+#
+# IP: Netfilter Configuration
+#
+CONFIG_NF_DEFRAG_IPV4=y
+CONFIG_NF_CONNTRACK_IPV4=y
+CONFIG_NF_CONNTRACK_PROC_COMPAT=y
+CONFIG_IP_NF_QUEUE=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+# CONFIG_IP_NF_MATCH_RPFILTER is not set
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP_NF_TARGET_ULOG=y
+CONFIG_NF_NAT=y
+CONFIG_NF_NAT_NEEDED=y
+CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_IP_NF_TARGET_NETMAP=y
+CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_NF_NAT_PROTO_UDPLITE=y
+# CONFIG_NF_NAT_FTP is not set
+# CONFIG_NF_NAT_IRC is not set
+# CONFIG_NF_NAT_TFTP is not set
+# CONFIG_NF_NAT_AMANDA is not set
+# CONFIG_NF_NAT_PPTP is not set
+# CONFIG_NF_NAT_H323 is not set
+# CONFIG_NF_NAT_SIP is not set
+CONFIG_IP_NF_MANGLE=y
+CONFIG_IP_NF_TARGET_CLUSTERIP=y
+CONFIG_IP_NF_TARGET_ECN=y
+CONFIG_IP_NF_TARGET_TTL=y
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_ARPTABLES=y
+CONFIG_IP_NF_ARPFILTER=y
+CONFIG_IP_NF_ARP_MANGLE=y
+
+#
+# IPv6: Netfilter Configuration
+#
+CONFIG_NF_DEFRAG_IPV6=y
+CONFIG_NF_CONNTRACK_IPV6=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_MATCH_AH=y
+CONFIG_IP6_NF_MATCH_EUI64=y
+CONFIG_IP6_NF_MATCH_FRAG=y
+CONFIG_IP6_NF_MATCH_OPTS=y
+CONFIG_IP6_NF_MATCH_HL=y
+CONFIG_IP6_NF_MATCH_IPV6HEADER=y
+CONFIG_IP6_NF_MATCH_MH=y
+# CONFIG_IP6_NF_MATCH_RPFILTER is not set
+CONFIG_IP6_NF_MATCH_RT=y
+CONFIG_IP6_NF_TARGET_HL=y
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_RAW=y
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_SCTP is not set
+# CONFIG_RDS is not set
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+CONFIG_L2TP=y
+# CONFIG_L2TP_V3 is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_NET_DSA is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
+# CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
+# CONFIG_BATMAN_ADV is not set
+# CONFIG_OPENVSWITCH is not set
+CONFIG_BQL=y
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_AF_RXRPC is not set
+CONFIG_FIB_RULES=y
+CONFIG_WIRELESS=y
+# CONFIG_CFG80211 is not set
+# CONFIG_LIB80211 is not set
+
+#
+# CFG80211 needs to be enabled for MAC80211
+#
+# CONFIG_WIMAX is not set
+# CONFIG_RFKILL is not set
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+# CONFIG_NET_9P_DEBUG is not set
+# CONFIG_CAIF is not set
+# CONFIG_CEPH_LIB is not set
+# CONFIG_NFC is not set
+CONFIG_HAVE_BPF_JIT=y
+
+#
+# Device Drivers
+#
+
+#
+# Generic Driver Options
+#
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_DEVTMPFS is not set
+CONFIG_STANDALONE=y
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+CONFIG_FW_LOADER=y
+CONFIG_FIRMWARE_IN_KERNEL=y
+CONFIG_EXTRA_FIRMWARE=""
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_SYS_HYPERVISOR is not set
+# CONFIG_GENERIC_CPU_DEVICES is not set
+# CONFIG_DMA_SHARED_BUFFER is not set
+# CONFIG_CONNECTOR is not set
+# CONFIG_MTD is not set
+# CONFIG_PARPORT is not set
+CONFIG_PNP=y
+CONFIG_PNP_DEBUG_MESSAGES=y
+
+#
+# Protocols
+#
+CONFIG_PNPACPI=y
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_FD is not set
+# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
+# CONFIG_BLK_CPQ_DA is not set
+# CONFIG_BLK_CPQ_CISS_DA is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+
+#
+# DRBD disabled because PROC_FS, INET or CONNECTOR not selected
+#
+CONFIG_BLK_DEV_NBD=y
+# CONFIG_BLK_DEV_NVME is not set
+# CONFIG_BLK_DEV_SX8 is not set
+# CONFIG_BLK_DEV_RAM is not set
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+CONFIG_VIRTIO_BLK=y
+# CONFIG_BLK_DEV_HD is not set
+# CONFIG_BLK_DEV_RBD is not set
+
+#
+# Misc devices
+#
+# CONFIG_SENSORS_LIS3LV02D is not set
+# CONFIG_IBM_ASM is not set
+# CONFIG_PHANTOM is not set
+# CONFIG_INTEL_MID_PTI is not set
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_HP_ILO is not set
+# CONFIG_VMWARE_BALLOON is not set
+# CONFIG_PCH_PHUB is not set
+# CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_CB710_CORE is not set
+
+#
+# Texas Instruments shared transport line discipline
+#
+
+#
+# Altera FPGA firmware download module
+#
+CONFIG_HAVE_IDE=y
+# CONFIG_IDE is not set
+
+#
+# SCSI device support
+#
+CONFIG_SCSI_MOD=y
+# CONFIG_RAID_ATTRS is not set
+# CONFIG_SCSI is not set
+# CONFIG_SCSI_DMA is not set
+# CONFIG_SCSI_NETLINK is not set
+# CONFIG_ATA is not set
+# CONFIG_MD is not set
+# CONFIG_FUSION is not set
+
+#
+# IEEE 1394 (FireWire) support
+#
+# CONFIG_FIREWIRE is not set
+# CONFIG_FIREWIRE_NOSY is not set
+# CONFIG_I2O is not set
+# CONFIG_MACINTOSH_DRIVERS is not set
+CONFIG_NETDEVICES=y
+CONFIG_NET_CORE=y
+# CONFIG_BONDING is not set
+CONFIG_DUMMY=y
+# CONFIG_EQUALIZER is not set
+# CONFIG_MII is not set
+# CONFIG_NET_TEAM is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+CONFIG_TUN=y
+# CONFIG_VETH is not set
+CONFIG_VIRTIO_NET=y
+# CONFIG_ARCNET is not set
+
+#
+# CAIF transport drivers
+#
+CONFIG_ETHERNET=y
+CONFIG_NET_VENDOR_3COM=y
+# CONFIG_VORTEX is not set
+# CONFIG_TYPHOON is not set
+CONFIG_NET_VENDOR_ADAPTEC=y
+# CONFIG_ADAPTEC_STARFIRE is not set
+CONFIG_NET_VENDOR_ALTEON=y
+# CONFIG_ACENIC is not set
+CONFIG_NET_VENDOR_AMD=y
+# CONFIG_AMD8111_ETH is not set
+# CONFIG_PCNET32 is not set
+CONFIG_NET_VENDOR_ATHEROS=y
+# CONFIG_ATL2 is not set
+# CONFIG_ATL1 is not set
+# CONFIG_ATL1E is not set
+# CONFIG_ATL1C is not set
+CONFIG_NET_VENDOR_BROADCOM=y
+# CONFIG_B44 is not set
+# CONFIG_BNX2 is not set
+# CONFIG_CNIC is not set
+# CONFIG_TIGON3 is not set
+# CONFIG_BNX2X is not set
+CONFIG_NET_VENDOR_BROCADE=y
+# CONFIG_BNA is not set
+# CONFIG_NET_CALXEDA_XGMAC is not set
+CONFIG_NET_VENDOR_CHELSIO=y
+# CONFIG_CHELSIO_T1 is not set
+# CONFIG_CHELSIO_T3 is not set
+# CONFIG_CHELSIO_T4 is not set
+# CONFIG_CHELSIO_T4VF is not set
+CONFIG_NET_VENDOR_CISCO=y
+# CONFIG_ENIC is not set
+# CONFIG_DNET is not set
+CONFIG_NET_VENDOR_DEC=y
+# CONFIG_NET_TULIP is not set
+CONFIG_NET_VENDOR_DLINK=y
+# CONFIG_DL2K is not set
+# CONFIG_SUNDANCE is not set
+CONFIG_NET_VENDOR_EMULEX=y
+# CONFIG_BE2NET is not set
+CONFIG_NET_VENDOR_EXAR=y
+# CONFIG_S2IO is not set
+# CONFIG_VXGE is not set
+CONFIG_NET_VENDOR_HP=y
+# CONFIG_HP100 is not set
+CONFIG_NET_VENDOR_INTEL=y
+# CONFIG_E100 is not set
+# CONFIG_E1000 is not set
+# CONFIG_E1000E is not set
+# CONFIG_IGB is not set
+# CONFIG_IGBVF is not set
+# CONFIG_IXGB is not set
+# CONFIG_IXGBE is not set
+# CONFIG_IXGBEVF is not set
+CONFIG_NET_VENDOR_I825XX=y
+# CONFIG_ZNET is not set
+# CONFIG_IP1000 is not set
+# CONFIG_JME is not set
+CONFIG_NET_VENDOR_MARVELL=y
+# CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
+CONFIG_NET_VENDOR_MELLANOX=y
+# CONFIG_MLX4_EN is not set
+# CONFIG_MLX4_CORE is not set
+CONFIG_NET_VENDOR_MICREL=y
+# CONFIG_KS8851_MLL is not set
+# CONFIG_KSZ884X_PCI is not set
+CONFIG_NET_VENDOR_MYRI=y
+# CONFIG_MYRI10GE is not set
+# CONFIG_FEALNX is not set
+CONFIG_NET_VENDOR_NATSEMI=y
+# CONFIG_NATSEMI is not set
+# CONFIG_NS83820 is not set
+CONFIG_NET_VENDOR_8390=y
+# CONFIG_NE2K_PCI is not set
+CONFIG_NET_VENDOR_NVIDIA=y
+# CONFIG_FORCEDETH is not set
+CONFIG_NET_VENDOR_OKI=y
+# CONFIG_PCH_GBE is not set
+# CONFIG_ETHOC is not set
+CONFIG_NET_PACKET_ENGINE=y
+# CONFIG_HAMACHI is not set
+# CONFIG_YELLOWFIN is not set
+CONFIG_NET_VENDOR_QLOGIC=y
+# CONFIG_QLA3XXX is not set
+# CONFIG_QLCNIC is not set
+# CONFIG_QLGE is not set
+# CONFIG_NETXEN_NIC is not set
+CONFIG_NET_VENDOR_REALTEK=y
+# CONFIG_8139CP is not set
+# CONFIG_8139TOO is not set
+# CONFIG_R8169 is not set
+CONFIG_NET_VENDOR_RDC=y
+# CONFIG_R6040 is not set
+CONFIG_NET_VENDOR_SEEQ=y
+# CONFIG_SEEQ8005 is not set
+CONFIG_NET_VENDOR_SILAN=y
+# CONFIG_SC92031 is not set
+CONFIG_NET_VENDOR_SIS=y
+# CONFIG_SIS900 is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SFC is not set
+CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_EPIC100 is not set
+# CONFIG_SMSC9420 is not set
+CONFIG_NET_VENDOR_STMICRO=y
+# CONFIG_STMMAC_ETH is not set
+CONFIG_NET_VENDOR_SUN=y
+# CONFIG_HAPPYMEAL is not set
+# CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
+# CONFIG_NIU is not set
+CONFIG_NET_VENDOR_TEHUTI=y
+# CONFIG_TEHUTI is not set
+CONFIG_NET_VENDOR_TI=y
+# CONFIG_TLAN is not set
+CONFIG_NET_VENDOR_VIA=y
+# CONFIG_VIA_RHINE is not set
+# CONFIG_VIA_VELOCITY is not set
+CONFIG_NET_VENDOR_WIZNET=y
+# CONFIG_WIZNET_W5100 is not set
+# CONFIG_WIZNET_W5300 is not set
+# CONFIG_FDDI is not set
+# CONFIG_HIPPI is not set
+# CONFIG_NET_SB1000 is not set
+# CONFIG_PHYLIB is not set
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+CONFIG_WLAN=y
+# CONFIG_AIRO is not set
+# CONFIG_ATMEL is not set
+# CONFIG_PRISM54 is not set
+# CONFIG_HOSTAP is not set
+# CONFIG_WL_TI is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+# CONFIG_WAN is not set
+# CONFIG_VMXNET3 is not set
+# CONFIG_ISDN is not set
+
+#
+# Input device support
+#
+CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
+# CONFIG_INPUT_POLLDEV is not set
+# CONFIG_INPUT_SPARSEKMAP is not set
+# CONFIG_INPUT_MATRIXKMAP is not set
+
+#
+# Userland interfaces
+#
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_EVDEV is not set
+# CONFIG_INPUT_EVBUG is not set
+
+#
+# Input Device Drivers
+#
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_KEYBOARD_ATKBD=y
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_OPENCORES is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_OMAP4 is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+CONFIG_INPUT_MOUSE=y
+CONFIG_MOUSE_PS2=y
+CONFIG_MOUSE_PS2_ALPS=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+CONFIG_MOUSE_PS2_LIFEBOOK=y
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_PS2_ELANTECH is not set
+# CONFIG_MOUSE_PS2_SENTELIC is not set
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+# CONFIG_MOUSE_SERIAL is not set
+# CONFIG_MOUSE_APPLETOUCH is not set
+# CONFIG_MOUSE_BCM5974 is not set
+# CONFIG_MOUSE_VSXXXAA is not set
+# CONFIG_MOUSE_SYNAPTICS_USB is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TABLET is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
+
+#
+# Hardware I/O ports
+#
+CONFIG_SERIO=y
+CONFIG_SERIO_I8042=y
+CONFIG_SERIO_SERPORT=y
+# CONFIG_SERIO_CT82C710 is not set
+# CONFIG_SERIO_PCIPS2 is not set
+CONFIG_SERIO_LIBPS2=y
+# CONFIG_SERIO_RAW is not set
+# CONFIG_SERIO_ALTERA_PS2 is not set
+# CONFIG_SERIO_PS2MULT is not set
+# CONFIG_GAMEPORT is not set
+
+#
+# Character devices
+#
+CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_HW_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
+CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=256
+# CONFIG_SERIAL_NONSTANDARD is not set
+# CONFIG_NOZOMI is not set
+# CONFIG_N_GSM is not set
+# CONFIG_TRACE_SINK is not set
+CONFIG_DEVKMEM=y
+
+#
+# Serial drivers
+#
+# CONFIG_SERIAL_8250 is not set
+CONFIG_FIX_EARLYCON_MEM=y
+
+#
+# Non-8250 serial port support
+#
+# CONFIG_SERIAL_MFD_HSU is not set
+# CONFIG_SERIAL_JSM is not set
+# CONFIG_SERIAL_TIMBERDALE is not set
+# CONFIG_SERIAL_ALTERA_JTAGUART is not set
+# CONFIG_SERIAL_ALTERA_UART is not set
+# CONFIG_SERIAL_PCH_UART is not set
+# CONFIG_SERIAL_XILINX_PS_UART is not set
+CONFIG_HVC_DRIVER=y
+CONFIG_VIRTIO_CONSOLE=y
+# CONFIG_IPMI_HANDLER is not set
+# CONFIG_HW_RANDOM is not set
+# CONFIG_NVRAM is not set
+# CONFIG_RTC is not set
+# CONFIG_GEN_RTC is not set
+# CONFIG_R3964 is not set
+# CONFIG_APPLICOM is not set
+# CONFIG_MWAVE is not set
+# CONFIG_RAW_DRIVER is not set
+# CONFIG_HPET is not set
+# CONFIG_HANGCHECK_TIMER is not set
+# CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
+CONFIG_DEVPORT=y
+# CONFIG_I2C is not set
+# CONFIG_SPI is not set
+# CONFIG_HSI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
+
+#
+# PPS generators support
+#
+
+#
+# PTP clock support
+#
+
+#
+# Enable Device Drivers -> PPS to see the PTP clock options.
+#
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+# CONFIG_GPIOLIB is not set
+# CONFIG_W1 is not set
+CONFIG_POWER_SUPPLY=y
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+# CONFIG_PDA_POWER is not set
+# CONFIG_TEST_POWER is not set
+# CONFIG_BATTERY_DS2780 is not set
+# CONFIG_BATTERY_DS2781 is not set
+# CONFIG_BATTERY_BQ27x00 is not set
+# CONFIG_CHARGER_MAX8903 is not set
+CONFIG_HWMON=y
+# CONFIG_HWMON_VID is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
+
+#
+# Native drivers
+#
+# CONFIG_SENSORS_ABITUGURU is not set
+# CONFIG_SENSORS_ABITUGURU3 is not set
+# CONFIG_SENSORS_K8TEMP is not set
+# CONFIG_SENSORS_K10TEMP is not set
+# CONFIG_SENSORS_FAM15H_POWER is not set
+# CONFIG_SENSORS_I5K_AMB is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_F71882FG is not set
+# CONFIG_SENSORS_CORETEMP is not set
+# CONFIG_SENSORS_IT87 is not set
+# CONFIG_SENSORS_NTC_THERMISTOR is not set
+# CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_SIS5595 is not set
+# CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_SCH56XX_COMMON is not set
+# CONFIG_SENSORS_VIA_CPUTEMP is not set
+# CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83627EHF is not set
+# CONFIG_SENSORS_APPLESMC is not set
+
+#
+# ACPI drivers
+#
+# CONFIG_SENSORS_ACPI_POWER is not set
+# CONFIG_SENSORS_ATK0110 is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_HWMON=y
+# CONFIG_WATCHDOG is not set
+CONFIG_SSB_POSSIBLE=y
+
+#
+# Sonics Silicon Backplane
+#
+# CONFIG_SSB is not set
+CONFIG_BCMA_POSSIBLE=y
+
+#
+# Broadcom specific AMBA
+#
+# CONFIG_BCMA is not set
+
+#
+# Multifunction device drivers
+#
+# CONFIG_MFD_CORE is not set
+# CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_ABX500_CORE is not set
+# CONFIG_MFD_CS5535 is not set
+# CONFIG_LPC_SCH is not set
+# CONFIG_LPC_ICH is not set
+# CONFIG_MFD_RDC321X is not set
+# CONFIG_MFD_JANZ_CMODIO is not set
+# CONFIG_MFD_VX855 is not set
+# CONFIG_REGULATOR is not set
+# CONFIG_MEDIA_SUPPORT is not set
+
+#
+# Graphics support
+#
+# CONFIG_AGP is not set
+CONFIG_VGA_ARB=y
+CONFIG_VGA_ARB_MAX_GPUS=16
+# CONFIG_VGA_SWITCHEROO is not set
+# CONFIG_DRM is not set
+# CONFIG_STUB_POULSBO is not set
+# CONFIG_VGASTATE is not set
+# CONFIG_VIDEO_OUTPUT_CONTROL is not set
+# CONFIG_FB is not set
+# CONFIG_EXYNOS_VIDEO is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
+
+#
+# Console display driver support
+#
+CONFIG_VGA_CONSOLE=y
+# CONFIG_VGACON_SOFT_SCROLLBACK is not set
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_SOUND=y
+# CONFIG_SOUND_OSS_CORE is not set
+# CONFIG_SND is not set
+# CONFIG_SOUND_PRIME is not set
+
+#
+# HID support
+#
+CONFIG_HID=y
+# CONFIG_HID_BATTERY_STRENGTH is not set
+# CONFIG_HIDRAW is not set
+CONFIG_HID_GENERIC=y
+
+#
+# Special HID drivers
+#
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
+CONFIG_USB_ARCH_HAS_XHCI=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_ARCH_HAS_HCD=y
+# CONFIG_USB is not set
+
+#
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may
+#
+# CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
+# CONFIG_UWB is not set
+# CONFIG_MMC is not set
+# CONFIG_MEMSTICK is not set
+# CONFIG_NEW_LEDS is not set
+# CONFIG_ACCESSIBILITY is not set
+# CONFIG_INFINIBAND is not set
+# CONFIG_EDAC is not set
+# CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
+# CONFIG_AUXDISPLAY is not set
+# CONFIG_UIO is not set
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_RING=y
+
+#
+# Virtio drivers
+#
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_MMIO=y
+# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set
+
+#
+# Microsoft Hyper-V guest support
+#
+# CONFIG_HYPERV is not set
+# CONFIG_STAGING is not set
+CONFIG_X86_PLATFORM_DEVICES=y
+# CONFIG_ACERHDF is not set
+# CONFIG_ASUS_LAPTOP is not set
+# CONFIG_FUJITSU_TABLET is not set
+# CONFIG_HP_ACCEL is not set
+# CONFIG_THINKPAD_ACPI is not set
+# CONFIG_SENSORS_HDAPS is not set
+# CONFIG_INTEL_MENLOW is not set
+# CONFIG_ACPI_WMI is not set
+# CONFIG_TOPSTAR_LAPTOP is not set
+# CONFIG_TOSHIBA_BT_RFKILL is not set
+# CONFIG_ACPI_CMPC is not set
+# CONFIG_INTEL_IPS is not set
+# CONFIG_IBM_RTL is not set
+# CONFIG_XO15_EBOOK is not set
+# CONFIG_SAMSUNG_Q10 is not set
+# CONFIG_APPLE_GMUX is not set
+
+#
+# Hardware Spinlock drivers
+#
+CONFIG_CLKEVT_I8253=y
+CONFIG_I8253_LOCK=y
+CONFIG_CLKBLD_I8253=y
+CONFIG_IOMMU_SUPPORT=y
+# CONFIG_AMD_IOMMU is not set
+# CONFIG_INTEL_IOMMU is not set
+# CONFIG_IRQ_REMAP is not set
+
+#
+# Remoteproc drivers (EXPERIMENTAL)
+#
+
+#
+# Rpmsg drivers (EXPERIMENTAL)
+#
+# CONFIG_VIRT_DRIVERS is not set
+# CONFIG_PM_DEVFREQ is not set
+# CONFIG_EXTCON is not set
+# CONFIG_MEMORY is not set
+# CONFIG_IIO is not set
+# CONFIG_VME_BUS is not set
+
+#
+# Firmware Drivers
+#
+# CONFIG_EDD is not set
+CONFIG_FIRMWARE_MEMMAP=y
+# CONFIG_DELL_RBU is not set
+# CONFIG_DCDBAS is not set
+CONFIG_DMIID=y
+# CONFIG_DMI_SYSFS is not set
+# CONFIG_ISCSI_IBFT_FIND is not set
+# CONFIG_GOOGLE_FIRMWARE is not set
+
+#
+# File systems
+#
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT2_FS_XIP is not set
+CONFIG_EXT3_FS=y
+# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
+# CONFIG_EXT3_FS_XATTR is not set
+# CONFIG_EXT4_FS is not set
+CONFIG_JBD=y
+CONFIG_REISERFS_FS=y
+# CONFIG_REISERFS_CHECK is not set
+# CONFIG_REISERFS_PROC_INFO is not set
+# CONFIG_REISERFS_FS_XATTR is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
+# CONFIG_NILFS2_FS is not set
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
+CONFIG_DNOTIFY=y
+CONFIG_INOTIFY_USER=y
+# CONFIG_FANOTIFY is not set
+CONFIG_QUOTA=y
+# CONFIG_QUOTA_NETLINK_INTERFACE is not set
+CONFIG_PRINT_QUOTA_WARNING=y
+# CONFIG_QUOTA_DEBUG is not set
+# CONFIG_QFMT_V1 is not set
+# CONFIG_QFMT_V2 is not set
+CONFIG_QUOTACTL=y
+CONFIG_AUTOFS4_FS=y
+# CONFIG_FUSE_FS is not set
+
+#
+# Caches
+#
+# CONFIG_FSCACHE is not set
+
+#
+# CD-ROM/DVD Filesystems
+#
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+# CONFIG_ZISOFS is not set
+# CONFIG_UDF_FS is not set
+
+#
+# DOS/FAT/NT Filesystems
+#
+# CONFIG_MSDOS_FS is not set
+# CONFIG_VFAT_FS is not set
+# CONFIG_NTFS_FS is not set
+
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_SYSFS=y
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_HUGETLBFS is not set
+# CONFIG_HUGETLB_PAGE is not set
+# CONFIG_CONFIGFS_FS is not set
+CONFIG_MISC_FILESYSTEMS=y
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_LOGFS is not set
+# CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_OMFS_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_QNX6FS_FS is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_PSTORE is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+CONFIG_NETWORK_FILESYSTEMS=y
+# CONFIG_NFS_FS is not set
+# CONFIG_NFSD is not set
+# CONFIG_CEPH_FS is not set
+# CONFIG_CIFS is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+CONFIG_9P_FS=y
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
+# CONFIG_NLS_CODEPAGE_437 is not set
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_ASCII is not set
+# CONFIG_NLS_ISO8859_1 is not set
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_MAC_ROMAN is not set
+# CONFIG_NLS_MAC_CELTIC is not set
+# CONFIG_NLS_MAC_CENTEURO is not set
+# CONFIG_NLS_MAC_CROATIAN is not set
+# CONFIG_NLS_MAC_CYRILLIC is not set
+# CONFIG_NLS_MAC_GAELIC is not set
+# CONFIG_NLS_MAC_GREEK is not set
+# CONFIG_NLS_MAC_ICELAND is not set
+# CONFIG_NLS_MAC_INUIT is not set
+# CONFIG_NLS_MAC_ROMANIAN is not set
+# CONFIG_NLS_MAC_TURKISH is not set
+# CONFIG_NLS_UTF8 is not set
+
+#
+# Kernel hacking
+#
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+# CONFIG_PRINTK_TIME is not set
+CONFIG_DEFAULT_MESSAGE_LOGLEVEL=4
+CONFIG_ENABLE_WARN_DEPRECATED=y
+CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
+# CONFIG_MAGIC_SYSRQ is not set
+# CONFIG_STRIP_ASM_SYMS is not set
+# CONFIG_READABLE_ASM is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
+# CONFIG_DEBUG_SECTION_MISMATCH is not set
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_SHIRQ is not set
+# CONFIG_LOCKUP_DETECTOR is not set
+# CONFIG_HARDLOCKUP_DETECTOR is not set
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_KMEMLEAK is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_SPARSE_RCU_POINTER is not set
+# CONFIG_LOCK_STAT is not set
+# CONFIG_DEBUG_ATOMIC_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_DEBUG_KOBJECT is not set
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_INFO_REDUCED is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_VIRTUAL is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
+CONFIG_DEBUG_MEMORY_INIT=y
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_TEST_LIST_SORT is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_CREDENTIALS is not set
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
+CONFIG_FRAME_POINTER=y
+# CONFIG_BOOT_PRINTK_DELAY is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RCU_TRACE is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_LATENCYTOP is not set
+# CONFIG_DEBUG_PAGEALLOC is not set
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_C_RECORDMCOUNT=y
+CONFIG_TRACING_SUPPORT=y
+CONFIG_FTRACE=y
+# CONFIG_FUNCTION_TRACER is not set
+# CONFIG_IRQSOFF_TRACER is not set
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_ENABLE_DEFAULT_TRACERS is not set
+# CONFIG_FTRACE_SYSCALLS is not set
+CONFIG_BRANCH_PROFILE_NONE=y
+# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
+# CONFIG_PROFILE_ALL_BRANCHES is not set
+# CONFIG_STACK_TRACER is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_UPROBE_EVENT is not set
+# CONFIG_PROBE_EVENTS is not set
+# CONFIG_MMIOTRACE is not set
+# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
+# CONFIG_DMA_API_DEBUG is not set
+# CONFIG_ATOMIC64_SELFTEST is not set
+# CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
+# CONFIG_KGDB is not set
+CONFIG_HAVE_ARCH_KMEMCHECK=y
+# CONFIG_TEST_KSTRTOX is not set
+# CONFIG_STRICT_DEVMEM is not set
+CONFIG_X86_VERBOSE_BOOTUP=y
+CONFIG_EARLY_PRINTK=y
+# CONFIG_EARLY_PRINTK_DBGP is not set
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_X86_PTDUMP is not set
+CONFIG_DEBUG_RODATA=y
+CONFIG_DEBUG_RODATA_TEST=y
+# CONFIG_IOMMU_DEBUG is not set
+# CONFIG_IOMMU_STRESS is not set
+CONFIG_HAVE_MMIOTRACE_SUPPORT=y
+CONFIG_IO_DELAY_TYPE_0X80=0
+CONFIG_IO_DELAY_TYPE_0XED=1
+CONFIG_IO_DELAY_TYPE_UDELAY=2
+CONFIG_IO_DELAY_TYPE_NONE=3
+CONFIG_IO_DELAY_0X80=y
+# CONFIG_IO_DELAY_0XED is not set
+# CONFIG_IO_DELAY_UDELAY is not set
+# CONFIG_IO_DELAY_NONE is not set
+CONFIG_DEFAULT_IO_DELAY_TYPE=0
+# CONFIG_CPA_DEBUG is not set
+# CONFIG_OPTIMIZE_INLINING is not set
+# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set
+# CONFIG_DEBUG_NMI_SELFTEST is not set
+
+#
+# Security options
+#
+# CONFIG_KEYS is not set
+# CONFIG_SECURITY_DMESG_RESTRICT is not set
+# CONFIG_SECURITY is not set
+# CONFIG_SECURITYFS is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY=""
+CONFIG_CRYPTO=y
+
+#
+# Crypto core or helper
+#
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_PCOMP=y
+CONFIG_CRYPTO_PCOMP2=y
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_USER=y
+CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
+CONFIG_CRYPTO_GF128MUL=y
+CONFIG_CRYPTO_NULL=y
+CONFIG_CRYPTO_WORKQUEUE=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_AUTHENC=y
+
+#
+# Authenticated Encryption with Associated Data
+#
+CONFIG_CRYPTO_CCM=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_SEQIV=y
+
+#
+# Block modes
+#
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTR=y
+# CONFIG_CRYPTO_CTS is not set
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_LRW=y
+CONFIG_CRYPTO_PCBC=y
+CONFIG_CRYPTO_XTS=y
+
+#
+# Hash modes
+#
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_XCBC=y
+# CONFIG_CRYPTO_VMAC is not set
+
+#
+# Digest
+#
+CONFIG_CRYPTO_CRC32C=y
+# CONFIG_CRYPTO_CRC32C_INTEL is not set
+CONFIG_CRYPTO_GHASH=y
+CONFIG_CRYPTO_MD4=y
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_MICHAEL_MIC=y
+CONFIG_CRYPTO_RMD128=y
+CONFIG_CRYPTO_RMD160=y
+CONFIG_CRYPTO_RMD256=y
+CONFIG_CRYPTO_RMD320=y
+CONFIG_CRYPTO_SHA1=y
+# CONFIG_CRYPTO_SHA1_SSSE3 is not set
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_TGR192=y
+CONFIG_CRYPTO_WP512=y
+# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set
+
+#
+# Ciphers
+#
+CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_AES_X86_64 is not set
+# CONFIG_CRYPTO_AES_NI_INTEL is not set
+CONFIG_CRYPTO_ANUBIS=y
+CONFIG_CRYPTO_ARC4=y
+CONFIG_CRYPTO_BLOWFISH=y
+CONFIG_CRYPTO_BLOWFISH_COMMON=y
+# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set
+CONFIG_CRYPTO_CAMELLIA=y
+# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set
+CONFIG_CRYPTO_CAST5=y
+CONFIG_CRYPTO_CAST6=y
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_FCRYPT=y
+CONFIG_CRYPTO_KHAZAD=y
+CONFIG_CRYPTO_SALSA20=y
+# CONFIG_CRYPTO_SALSA20_X86_64 is not set
+CONFIG_CRYPTO_SEED=y
+CONFIG_CRYPTO_SERPENT=y
+# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set
+CONFIG_CRYPTO_TEA=y
+CONFIG_CRYPTO_TWOFISH=y
+CONFIG_CRYPTO_TWOFISH_COMMON=y
+# CONFIG_CRYPTO_TWOFISH_X86_64 is not set
+# CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set
+
+#
+# Compression
+#
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_ZLIB=y
+# CONFIG_CRYPTO_LZO is not set
+
+#
+# Random Number Generation
+#
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_USER_API=y
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+# CONFIG_CRYPTO_HW is not set
+CONFIG_HAVE_KVM=y
+CONFIG_VIRTUALIZATION=y
+# CONFIG_KVM is not set
+# CONFIG_VHOST_NET is not set
+# CONFIG_BINARY_PRINTF is not set
+
+#
+# Library routines
+#
+CONFIG_BITREVERSE=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IO=y
+CONFIG_CRC_CCITT=y
+CONFIG_CRC16=y
+# CONFIG_CRC_T10DIF is not set
+CONFIG_CRC_ITU_T=y
+CONFIG_CRC32=y
+# CONFIG_CRC32_SELFTEST is not set
+CONFIG_CRC32_SLICEBY8=y
+# CONFIG_CRC32_SLICEBY4 is not set
+# CONFIG_CRC32_SARWATE is not set
+# CONFIG_CRC32_BIT is not set
+CONFIG_CRC7=y
+CONFIG_LIBCRC32C=y
+# CONFIG_CRC8 is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
+# CONFIG_XZ_DEC is not set
+# CONFIG_XZ_DEC_BCJ is not set
+CONFIG_TEXTSEARCH=y
+CONFIG_TEXTSEARCH_KMP=y
+CONFIG_TEXTSEARCH_BM=y
+CONFIG_TEXTSEARCH_FSM=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAS_DMA=y
+CONFIG_DQL=y
+CONFIG_NLATTR=y
+# CONFIG_AVERAGE is not set
+# CONFIG_CORDIC is not set
+# CONFIG_DDR is not set
diff --git a/testing/config/kernel/config-3.6 b/testing/config/kernel/config-3.6
new file mode 100644
index 000000000..8755bf772
--- /dev/null
+++ b/testing/config/kernel/config-3.6
@@ -0,0 +1,1830 @@
+#
+# Automatically generated file; DO NOT EDIT.
+# Linux/x86_64 3.6.11 Kernel Configuration
+#
+CONFIG_64BIT=y
+# CONFIG_X86_32 is not set
+CONFIG_X86_64=y
+CONFIG_X86=y
+CONFIG_INSTRUCTION_DECODER=y
+CONFIG_OUTPUT_FORMAT="elf64-x86-64"
+CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig"
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_HAVE_LATENCYTOP_SUPPORT=y
+CONFIG_MMU=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+# CONFIG_RWSEM_GENERIC_SPINLOCK is not set
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_ARCH_HAS_CPU_RELAX=y
+CONFIG_ARCH_HAS_DEFAULT_IDLE=y
+CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
+CONFIG_ARCH_HAS_CPU_AUTOPROBE=y
+CONFIG_HAVE_SETUP_PER_CPU_AREA=y
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
+CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ZONE_DMA32=y
+CONFIG_AUDIT_ARCH=y
+CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y
+CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
+CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11"
+CONFIG_ARCH_SUPPORTS_UPROBES=y
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_HAVE_IRQ_WORK=y
+CONFIG_IRQ_WORK=y
+CONFIG_BUILDTIME_EXTABLE_SORT=y
+
+#
+# General setup
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_BROKEN_ON_SMP=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_CROSS_COMPILE=""
+CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION_AUTO=y
+CONFIG_HAVE_KERNEL_GZIP=y
+CONFIG_HAVE_KERNEL_BZIP2=y
+CONFIG_HAVE_KERNEL_LZMA=y
+CONFIG_HAVE_KERNEL_XZ=y
+CONFIG_HAVE_KERNEL_LZO=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_BZIP2 is not set
+# CONFIG_KERNEL_LZMA is not set
+# CONFIG_KERNEL_XZ is not set
+# CONFIG_KERNEL_LZO is not set
+CONFIG_DEFAULT_HOSTNAME="(none)"
+CONFIG_SWAP=y
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_BSD_PROCESS_ACCT=y
+# CONFIG_BSD_PROCESS_ACCT_V3 is not set
+# CONFIG_FHANDLE is not set
+# CONFIG_TASKSTATS is not set
+# CONFIG_AUDIT is not set
+CONFIG_HAVE_GENERIC_HARDIRQS=y
+
+#
+# IRQ subsystem
+#
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_ARCH_CLOCKSOURCE_DATA=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+
+#
+# Timers subsystem
+#
+CONFIG_TICK_ONESHOT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+
+#
+# RCU Subsystem
+#
+CONFIG_TINY_RCU=y
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
+# CONFIG_CGROUPS is not set
+# CONFIG_CHECKPOINT_RESTORE is not set
+CONFIG_NAMESPACES=y
+# CONFIG_UTS_NS is not set
+# CONFIG_IPC_NS is not set
+# CONFIG_PID_NS is not set
+# CONFIG_NET_NS is not set
+# CONFIG_SCHED_AUTOGROUP is not set
+# CONFIG_SYSFS_DEPRECATED is not set
+# CONFIG_RELAY is not set
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SYSCTL=y
+CONFIG_ANON_INODES=y
+# CONFIG_EXPERT is not set
+# CONFIG_SYSCTL_SYSCALL is not set
+CONFIG_KALLSYMS=y
+# CONFIG_KALLSYMS_ALL is not set
+CONFIG_HOTPLUG=y
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
+CONFIG_PCSPKR_PLATFORM=y
+CONFIG_HAVE_PCSPKR_PLATFORM=y
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
+CONFIG_EPOLL=y
+CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
+CONFIG_EVENTFD=y
+CONFIG_SHMEM=y
+CONFIG_AIO=y
+# CONFIG_EMBEDDED is not set
+CONFIG_HAVE_PERF_EVENTS=y
+
+#
+# Kernel Performance Events And Counters
+#
+CONFIG_PERF_EVENTS=y
+# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_PCI_QUIRKS=y
+CONFIG_COMPAT_BRK=y
+CONFIG_SLAB=y
+# CONFIG_SLUB is not set
+# CONFIG_PROFILING is not set
+CONFIG_HAVE_OPROFILE=y
+CONFIG_OPROFILE_NMI_TIMER=y
+# CONFIG_JUMP_LABEL is not set
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
+CONFIG_HAVE_IOREMAP_PROT=y
+CONFIG_HAVE_KPROBES=y
+CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_OPTPROBES=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_HW_BREAKPOINT=y
+CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y
+CONFIG_HAVE_USER_RETURN_NOTIFIER=y
+CONFIG_HAVE_PERF_EVENTS_NMI=y
+CONFIG_HAVE_ARCH_JUMP_LABEL=y
+CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
+CONFIG_HAVE_CMPXCHG_LOCAL=y
+CONFIG_HAVE_CMPXCHG_DOUBLE=y
+CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
+CONFIG_SECCOMP_FILTER=y
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
+CONFIG_SLABINFO=y
+CONFIG_RT_MUTEXES=y
+CONFIG_BASE_SMALL=0
+# CONFIG_MODULES is not set
+CONFIG_BLOCK=y
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_BLK_DEV_BSGLIB is not set
+# CONFIG_BLK_DEV_INTEGRITY is not set
+
+#
+# Partition Types
+#
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_MSDOS_PARTITION=y
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_DEFAULT_DEADLINE is not set
+CONFIG_DEFAULT_CFQ=y
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+# CONFIG_INLINE_SPIN_TRYLOCK is not set
+# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK is not set
+# CONFIG_INLINE_SPIN_LOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
+# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
+CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_READ_TRYLOCK is not set
+# CONFIG_INLINE_READ_LOCK is not set
+# CONFIG_INLINE_READ_LOCK_BH is not set
+# CONFIG_INLINE_READ_LOCK_IRQ is not set
+# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
+CONFIG_INLINE_READ_UNLOCK=y
+# CONFIG_INLINE_READ_UNLOCK_BH is not set
+CONFIG_INLINE_READ_UNLOCK_IRQ=y
+# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_WRITE_TRYLOCK is not set
+# CONFIG_INLINE_WRITE_LOCK is not set
+# CONFIG_INLINE_WRITE_LOCK_BH is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
+CONFIG_INLINE_WRITE_UNLOCK=y
+# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
+CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
+# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
+# CONFIG_MUTEX_SPIN_ON_OWNER is not set
+CONFIG_FREEZER=y
+
+#
+# Processor type and features
+#
+CONFIG_ZONE_DMA=y
+# CONFIG_SMP is not set
+CONFIG_X86_MPPARSE=y
+CONFIG_X86_EXTENDED_PLATFORM=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
+CONFIG_PARAVIRT_GUEST=y
+# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
+# CONFIG_XEN is not set
+# CONFIG_XEN_PRIVILEGED_GUEST is not set
+CONFIG_KVM_CLOCK=y
+CONFIG_KVM_GUEST=y
+CONFIG_PARAVIRT=y
+CONFIG_PARAVIRT_CLOCK=y
+# CONFIG_PARAVIRT_DEBUG is not set
+CONFIG_NO_BOOTMEM=y
+# CONFIG_MEMTEST is not set
+# CONFIG_MK8 is not set
+# CONFIG_MPSC is not set
+CONFIG_MCORE2=y
+# CONFIG_MATOM is not set
+# CONFIG_GENERIC_CPU is not set
+CONFIG_X86_INTERNODE_CACHE_SHIFT=6
+CONFIG_X86_CMPXCHG=y
+CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_XADD=y
+CONFIG_X86_WP_WORKS_OK=y
+CONFIG_X86_INTEL_USERCOPY=y
+CONFIG_X86_USE_PPRO_CHECKSUM=y
+CONFIG_X86_P6_NOP=y
+CONFIG_X86_TSC=y
+CONFIG_X86_CMPXCHG64=y
+CONFIG_X86_CMOV=y
+CONFIG_X86_MINIMUM_CPU_FAMILY=64
+CONFIG_X86_DEBUGCTLMSR=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR=y
+CONFIG_HPET_TIMER=y
+CONFIG_DMI=y
+CONFIG_GART_IOMMU=y
+# CONFIG_CALGARY_IOMMU is not set
+CONFIG_SWIOTLB=y
+CONFIG_IOMMU_HELPER=y
+CONFIG_NR_CPUS=1
+# CONFIG_IRQ_TIME_ACCOUNTING is not set
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT is not set
+CONFIG_X86_LOCAL_APIC=y
+CONFIG_X86_IO_APIC=y
+# CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set
+# CONFIG_X86_MCE is not set
+# CONFIG_I8K is not set
+# CONFIG_MICROCODE is not set
+# CONFIG_X86_MSR is not set
+# CONFIG_X86_CPUID is not set
+CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_DIRECT_GBPAGES=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_MEMORY_PROBE=y
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_SPARSEMEM_MANUAL=y
+CONFIG_SPARSEMEM=y
+CONFIG_HAVE_MEMORY_PRESENT=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_HAVE_MEMBLOCK=y
+CONFIG_HAVE_MEMBLOCK_NODE_MAP=y
+CONFIG_ARCH_DISCARD_MEMBLOCK=y
+CONFIG_MEMORY_ISOLATION=y
+CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTPLUG_SPARSE=y
+CONFIG_MEMORY_HOTREMOVE=y
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_COMPACTION is not set
+CONFIG_MIGRATION=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_ZONE_DMA_FLAG=1
+CONFIG_BOUNCE=y
+CONFIG_VIRT_TO_BUS=y
+# CONFIG_KSM is not set
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
+# CONFIG_TRANSPARENT_HUGEPAGE is not set
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_NEED_PER_CPU_KM=y
+# CONFIG_CLEANCACHE is not set
+# CONFIG_FRONTSWAP is not set
+# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set
+CONFIG_X86_RESERVE_LOW=64
+CONFIG_MTRR=y
+CONFIG_MTRR_SANITIZER=y
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
+CONFIG_X86_PAT=y
+CONFIG_ARCH_USES_PG_UNCACHED=y
+CONFIG_ARCH_RANDOM=y
+# CONFIG_EFI is not set
+CONFIG_SECCOMP=y
+# CONFIG_CC_STACKPROTECTOR is not set
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=250
+CONFIG_SCHED_HRTICK=y
+# CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
+CONFIG_PHYSICAL_START=0x1000000
+CONFIG_RELOCATABLE=y
+CONFIG_PHYSICAL_ALIGN=0x1000000
+# CONFIG_CMDLINE_BOOL is not set
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
+CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
+
+#
+# Power management and ACPI options
+#
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+# CONFIG_HIBERNATION is not set
+CONFIG_PM_SLEEP=y
+# CONFIG_PM_AUTOSLEEP is not set
+# CONFIG_PM_WAKELOCKS is not set
+# CONFIG_PM_RUNTIME is not set
+CONFIG_PM=y
+# CONFIG_PM_DEBUG is not set
+CONFIG_ACPI=y
+CONFIG_ACPI_SLEEP=y
+# CONFIG_ACPI_PROCFS is not set
+# CONFIG_ACPI_PROCFS_POWER is not set
+# CONFIG_ACPI_EC_DEBUGFS is not set
+CONFIG_ACPI_PROC_EVENT=y
+CONFIG_ACPI_AC=y
+CONFIG_ACPI_BATTERY=y
+CONFIG_ACPI_BUTTON=y
+CONFIG_ACPI_FAN=y
+# CONFIG_ACPI_DOCK is not set
+CONFIG_ACPI_PROCESSOR=y
+# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
+CONFIG_ACPI_THERMAL=y
+# CONFIG_ACPI_CUSTOM_DSDT is not set
+CONFIG_ACPI_BLACKLIST_YEAR=0
+# CONFIG_ACPI_DEBUG is not set
+# CONFIG_ACPI_PCI_SLOT is not set
+CONFIG_X86_PM_TIMER=y
+# CONFIG_ACPI_CONTAINER is not set
+# CONFIG_ACPI_HOTPLUG_MEMORY is not set
+# CONFIG_ACPI_SBS is not set
+# CONFIG_ACPI_HED is not set
+# CONFIG_ACPI_BGRT is not set
+# CONFIG_ACPI_APEI is not set
+# CONFIG_SFI is not set
+
+#
+# CPU Frequency scaling
+#
+# CONFIG_CPU_FREQ is not set
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+# CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set
+# CONFIG_INTEL_IDLE is not set
+
+#
+# Memory power savings
+#
+# CONFIG_I7300_IDLE is not set
+
+#
+# Bus options (PCI etc.)
+#
+CONFIG_PCI=y
+CONFIG_PCI_DIRECT=y
+# CONFIG_PCI_MMCONFIG is not set
+CONFIG_PCI_DOMAINS=y
+# CONFIG_PCI_CNB20LE_QUIRK is not set
+# CONFIG_PCIEPORTBUS is not set
+CONFIG_ARCH_SUPPORTS_MSI=y
+CONFIG_PCI_MSI=y
+# CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set
+# CONFIG_PCI_STUB is not set
+CONFIG_HT_IRQ=y
+# CONFIG_PCI_IOV is not set
+# CONFIG_PCI_PRI is not set
+# CONFIG_PCI_PASID is not set
+# CONFIG_PCI_IOAPIC is not set
+CONFIG_PCI_LABEL=y
+CONFIG_ISA_DMA_API=y
+CONFIG_AMD_NB=y
+# CONFIG_PCCARD is not set
+# CONFIG_HOTPLUG_PCI is not set
+# CONFIG_RAPIDIO is not set
+
+#
+# Executable file formats / Emulations
+#
+CONFIG_BINFMT_ELF=y
+CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_HAVE_AOUT is not set
+# CONFIG_BINFMT_MISC is not set
+# CONFIG_IA32_EMULATION is not set
+# CONFIG_COMPAT_FOR_U64_ALIGNMENT is not set
+CONFIG_HAVE_TEXT_POKE_SMP=y
+CONFIG_X86_DEV_DMA_OPS=y
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+# CONFIG_UNIX_DIAG is not set
+CONFIG_XFRM=y
+CONFIG_XFRM_ALGO=y
+CONFIG_XFRM_USER=y
+CONFIG_XFRM_SUB_POLICY=y
+CONFIG_XFRM_MIGRATE=y
+CONFIG_XFRM_STATISTICS=y
+CONFIG_XFRM_IPCOMP=y
+CONFIG_NET_KEY=y
+CONFIG_NET_KEY_MIGRATE=y
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+CONFIG_IP_ADVANCED_ROUTER=y
+# CONFIG_IP_FIB_TRIE_STATS is not set
+CONFIG_IP_MULTIPLE_TABLES=y
+# CONFIG_IP_ROUTE_MULTIPATH is not set
+# CONFIG_IP_ROUTE_VERBOSE is not set
+CONFIG_IP_ROUTE_CLASSID=y
+# CONFIG_IP_PNP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE_DEMUX is not set
+# CONFIG_ARPD is not set
+# CONFIG_SYN_COOKIES is not set
+# CONFIG_NET_IPVTI is not set
+CONFIG_INET_AH=y
+CONFIG_INET_ESP=y
+CONFIG_INET_IPCOMP=y
+CONFIG_INET_XFRM_TUNNEL=y
+CONFIG_INET_TUNNEL=y
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
+# CONFIG_INET_LRO is not set
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_INET_UDP_DIAG is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
+CONFIG_IPV6=y
+# CONFIG_IPV6_PRIVACY is not set
+# CONFIG_IPV6_ROUTER_PREF is not set
+CONFIG_IPV6_OPTIMISTIC_DAD=y
+CONFIG_INET6_AH=y
+CONFIG_INET6_ESP=y
+CONFIG_INET6_IPCOMP=y
+CONFIG_IPV6_MIP6=y
+CONFIG_INET6_XFRM_TUNNEL=y
+CONFIG_INET6_TUNNEL=y
+CONFIG_INET6_XFRM_MODE_TRANSPORT=y
+CONFIG_INET6_XFRM_MODE_TUNNEL=y
+CONFIG_INET6_XFRM_MODE_BEET=y
+# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+# CONFIG_IPV6_SIT is not set
+# CONFIG_IPV6_TUNNEL is not set
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+# CONFIG_IPV6_MROUTE is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_DEBUG is not set
+CONFIG_NETFILTER_ADVANCED=y
+
+#
+# Core Netfilter Configuration
+#
+CONFIG_NETFILTER_NETLINK=y
+# CONFIG_NETFILTER_NETLINK_ACCT is not set
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_PROCFS=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+# CONFIG_NF_CONNTRACK_TIMEOUT is not set
+# CONFIG_NF_CONNTRACK_TIMESTAMP is not set
+# CONFIG_NF_CT_PROTO_DCCP is not set
+# CONFIG_NF_CT_PROTO_SCTP is not set
+CONFIG_NF_CT_PROTO_UDPLITE=y
+# CONFIG_NF_CONNTRACK_AMANDA is not set
+# CONFIG_NF_CONNTRACK_FTP is not set
+# CONFIG_NF_CONNTRACK_H323 is not set
+# CONFIG_NF_CONNTRACK_IRC is not set
+# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set
+# CONFIG_NF_CONNTRACK_SNMP is not set
+# CONFIG_NF_CONNTRACK_PPTP is not set
+CONFIG_NF_CONNTRACK_SANE=y
+# CONFIG_NF_CONNTRACK_SIP is not set
+# CONFIG_NF_CONNTRACK_TFTP is not set
+CONFIG_NF_CT_NETLINK=y
+# CONFIG_NF_CT_NETLINK_TIMEOUT is not set
+# CONFIG_NETFILTER_NETLINK_QUEUE_CT is not set
+# CONFIG_NETFILTER_TPROXY is not set
+CONFIG_NETFILTER_XTABLES=y
+
+#
+# Xtables combined modules
+#
+CONFIG_NETFILTER_XT_MARK=y
+CONFIG_NETFILTER_XT_CONNMARK=y
+CONFIG_NETFILTER_XT_SET=y
+
+#
+# Xtables targets
+#
+# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+# CONFIG_NETFILTER_XT_TARGET_CT is not set
+CONFIG_NETFILTER_XT_TARGET_DSCP=y
+CONFIG_NETFILTER_XT_TARGET_HL=y
+# CONFIG_NETFILTER_XT_TARGET_HMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set
+CONFIG_NETFILTER_XT_TARGET_LOG=y
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
+# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
+# CONFIG_NETFILTER_XT_TARGET_TEE is not set
+CONFIG_NETFILTER_XT_TARGET_TRACE=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
+
+#
+# Xtables matches
+#
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=y
+CONFIG_NETFILTER_XT_MATCH_COMMENT=y
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+# CONFIG_NETFILTER_XT_MATCH_CPU is not set
+CONFIG_NETFILTER_XT_MATCH_DCCP=y
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y
+CONFIG_NETFILTER_XT_MATCH_DSCP=y
+CONFIG_NETFILTER_XT_MATCH_ECN=y
+CONFIG_NETFILTER_XT_MATCH_ESP=y
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_HL=y
+# CONFIG_NETFILTER_XT_MATCH_IPRANGE is not set
+CONFIG_NETFILTER_XT_MATCH_LENGTH=y
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
+CONFIG_NETFILTER_XT_MATCH_MAC=y
+CONFIG_NETFILTER_XT_MATCH_MARK=y
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
+# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
+# CONFIG_NETFILTER_XT_MATCH_OSF is not set
+# CONFIG_NETFILTER_XT_MATCH_OWNER is not set
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA=y
+# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set
+CONFIG_NETFILTER_XT_MATCH_REALM=y
+# CONFIG_NETFILTER_XT_MATCH_RECENT is not set
+CONFIG_NETFILTER_XT_MATCH_SCTP=y
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
+CONFIG_NETFILTER_XT_MATCH_STRING=y
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=y
+# CONFIG_NETFILTER_XT_MATCH_TIME is not set
+CONFIG_NETFILTER_XT_MATCH_U32=y
+CONFIG_IP_SET=y
+CONFIG_IP_SET_MAX=256
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+# CONFIG_IP_SET_HASH_NETIFACE is not set
+CONFIG_IP_SET_LIST_SET=y
+# CONFIG_IP_VS is not set
+
+#
+# IP: Netfilter Configuration
+#
+CONFIG_NF_DEFRAG_IPV4=y
+CONFIG_NF_CONNTRACK_IPV4=y
+CONFIG_NF_CONNTRACK_PROC_COMPAT=y
+CONFIG_IP_NF_QUEUE=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+# CONFIG_IP_NF_MATCH_RPFILTER is not set
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP_NF_TARGET_ULOG=y
+CONFIG_NF_NAT=y
+CONFIG_NF_NAT_NEEDED=y
+CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_IP_NF_TARGET_NETMAP=y
+CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_NF_NAT_PROTO_UDPLITE=y
+# CONFIG_NF_NAT_FTP is not set
+# CONFIG_NF_NAT_IRC is not set
+# CONFIG_NF_NAT_TFTP is not set
+# CONFIG_NF_NAT_AMANDA is not set
+# CONFIG_NF_NAT_PPTP is not set
+# CONFIG_NF_NAT_H323 is not set
+# CONFIG_NF_NAT_SIP is not set
+CONFIG_IP_NF_MANGLE=y
+CONFIG_IP_NF_TARGET_CLUSTERIP=y
+CONFIG_IP_NF_TARGET_ECN=y
+CONFIG_IP_NF_TARGET_TTL=y
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_ARPTABLES=y
+CONFIG_IP_NF_ARPFILTER=y
+CONFIG_IP_NF_ARP_MANGLE=y
+
+#
+# IPv6: Netfilter Configuration
+#
+CONFIG_NF_DEFRAG_IPV6=y
+CONFIG_NF_CONNTRACK_IPV6=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_MATCH_AH=y
+CONFIG_IP6_NF_MATCH_EUI64=y
+CONFIG_IP6_NF_MATCH_FRAG=y
+CONFIG_IP6_NF_MATCH_OPTS=y
+CONFIG_IP6_NF_MATCH_HL=y
+CONFIG_IP6_NF_MATCH_IPV6HEADER=y
+CONFIG_IP6_NF_MATCH_MH=y
+# CONFIG_IP6_NF_MATCH_RPFILTER is not set
+CONFIG_IP6_NF_MATCH_RT=y
+CONFIG_IP6_NF_TARGET_HL=y
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_RAW=y
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_SCTP is not set
+# CONFIG_RDS is not set
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+CONFIG_L2TP=y
+# CONFIG_L2TP_V3 is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_NET_DSA is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
+# CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
+# CONFIG_BATMAN_ADV is not set
+# CONFIG_OPENVSWITCH is not set
+CONFIG_BQL=y
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_AF_RXRPC is not set
+CONFIG_FIB_RULES=y
+CONFIG_WIRELESS=y
+# CONFIG_CFG80211 is not set
+# CONFIG_LIB80211 is not set
+
+#
+# CFG80211 needs to be enabled for MAC80211
+#
+# CONFIG_WIMAX is not set
+# CONFIG_RFKILL is not set
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+# CONFIG_NET_9P_DEBUG is not set
+# CONFIG_CAIF is not set
+# CONFIG_CEPH_LIB is not set
+# CONFIG_NFC is not set
+CONFIG_HAVE_BPF_JIT=y
+
+#
+# Device Drivers
+#
+
+#
+# Generic Driver Options
+#
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_DEVTMPFS is not set
+CONFIG_STANDALONE=y
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+CONFIG_FW_LOADER=y
+CONFIG_FIRMWARE_IN_KERNEL=y
+CONFIG_EXTRA_FIRMWARE=""
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_SYS_HYPERVISOR is not set
+# CONFIG_GENERIC_CPU_DEVICES is not set
+# CONFIG_DMA_SHARED_BUFFER is not set
+# CONFIG_CONNECTOR is not set
+# CONFIG_MTD is not set
+# CONFIG_PARPORT is not set
+CONFIG_PNP=y
+CONFIG_PNP_DEBUG_MESSAGES=y
+
+#
+# Protocols
+#
+CONFIG_PNPACPI=y
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_FD is not set
+# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
+# CONFIG_BLK_CPQ_DA is not set
+# CONFIG_BLK_CPQ_CISS_DA is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+
+#
+# DRBD disabled because PROC_FS, INET or CONNECTOR not selected
+#
+CONFIG_BLK_DEV_NBD=y
+# CONFIG_BLK_DEV_NVME is not set
+# CONFIG_BLK_DEV_SX8 is not set
+# CONFIG_BLK_DEV_RAM is not set
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+CONFIG_VIRTIO_BLK=y
+# CONFIG_BLK_DEV_HD is not set
+# CONFIG_BLK_DEV_RBD is not set
+
+#
+# Misc devices
+#
+# CONFIG_SENSORS_LIS3LV02D is not set
+# CONFIG_IBM_ASM is not set
+# CONFIG_PHANTOM is not set
+# CONFIG_INTEL_MID_PTI is not set
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_HP_ILO is not set
+# CONFIG_VMWARE_BALLOON is not set
+# CONFIG_PCH_PHUB is not set
+# CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_CB710_CORE is not set
+
+#
+# Texas Instruments shared transport line discipline
+#
+
+#
+# Altera FPGA firmware download module
+#
+CONFIG_HAVE_IDE=y
+# CONFIG_IDE is not set
+
+#
+# SCSI device support
+#
+CONFIG_SCSI_MOD=y
+# CONFIG_RAID_ATTRS is not set
+# CONFIG_SCSI is not set
+# CONFIG_SCSI_DMA is not set
+# CONFIG_SCSI_NETLINK is not set
+# CONFIG_ATA is not set
+# CONFIG_MD is not set
+# CONFIG_FUSION is not set
+
+#
+# IEEE 1394 (FireWire) support
+#
+# CONFIG_FIREWIRE is not set
+# CONFIG_FIREWIRE_NOSY is not set
+# CONFIG_I2O is not set
+# CONFIG_MACINTOSH_DRIVERS is not set
+CONFIG_NETDEVICES=y
+CONFIG_NET_CORE=y
+# CONFIG_BONDING is not set
+CONFIG_DUMMY=y
+# CONFIG_EQUALIZER is not set
+# CONFIG_MII is not set
+# CONFIG_NET_TEAM is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+CONFIG_TUN=y
+# CONFIG_VETH is not set
+CONFIG_VIRTIO_NET=y
+# CONFIG_ARCNET is not set
+
+#
+# CAIF transport drivers
+#
+CONFIG_ETHERNET=y
+CONFIG_NET_VENDOR_3COM=y
+# CONFIG_VORTEX is not set
+# CONFIG_TYPHOON is not set
+CONFIG_NET_VENDOR_ADAPTEC=y
+# CONFIG_ADAPTEC_STARFIRE is not set
+CONFIG_NET_VENDOR_ALTEON=y
+# CONFIG_ACENIC is not set
+CONFIG_NET_VENDOR_AMD=y
+# CONFIG_AMD8111_ETH is not set
+# CONFIG_PCNET32 is not set
+CONFIG_NET_VENDOR_ATHEROS=y
+# CONFIG_ATL2 is not set
+# CONFIG_ATL1 is not set
+# CONFIG_ATL1E is not set
+# CONFIG_ATL1C is not set
+CONFIG_NET_VENDOR_BROADCOM=y
+# CONFIG_B44 is not set
+# CONFIG_BNX2 is not set
+# CONFIG_CNIC is not set
+# CONFIG_TIGON3 is not set
+# CONFIG_BNX2X is not set
+CONFIG_NET_VENDOR_BROCADE=y
+# CONFIG_BNA is not set
+# CONFIG_NET_CALXEDA_XGMAC is not set
+CONFIG_NET_VENDOR_CHELSIO=y
+# CONFIG_CHELSIO_T1 is not set
+# CONFIG_CHELSIO_T3 is not set
+# CONFIG_CHELSIO_T4 is not set
+# CONFIG_CHELSIO_T4VF is not set
+CONFIG_NET_VENDOR_CISCO=y
+# CONFIG_ENIC is not set
+# CONFIG_DNET is not set
+CONFIG_NET_VENDOR_DEC=y
+# CONFIG_NET_TULIP is not set
+CONFIG_NET_VENDOR_DLINK=y
+# CONFIG_DL2K is not set
+# CONFIG_SUNDANCE is not set
+CONFIG_NET_VENDOR_EMULEX=y
+# CONFIG_BE2NET is not set
+CONFIG_NET_VENDOR_EXAR=y
+# CONFIG_S2IO is not set
+# CONFIG_VXGE is not set
+CONFIG_NET_VENDOR_HP=y
+# CONFIG_HP100 is not set
+CONFIG_NET_VENDOR_INTEL=y
+# CONFIG_E100 is not set
+# CONFIG_E1000 is not set
+# CONFIG_E1000E is not set
+# CONFIG_IGB is not set
+# CONFIG_IGBVF is not set
+# CONFIG_IXGB is not set
+# CONFIG_IXGBE is not set
+# CONFIG_IXGBEVF is not set
+CONFIG_NET_VENDOR_I825XX=y
+# CONFIG_ZNET is not set
+# CONFIG_IP1000 is not set
+# CONFIG_JME is not set
+CONFIG_NET_VENDOR_MARVELL=y
+# CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
+CONFIG_NET_VENDOR_MELLANOX=y
+# CONFIG_MLX4_EN is not set
+# CONFIG_MLX4_CORE is not set
+CONFIG_NET_VENDOR_MICREL=y
+# CONFIG_KS8851_MLL is not set
+# CONFIG_KSZ884X_PCI is not set
+CONFIG_NET_VENDOR_MYRI=y
+# CONFIG_MYRI10GE is not set
+# CONFIG_FEALNX is not set
+CONFIG_NET_VENDOR_NATSEMI=y
+# CONFIG_NATSEMI is not set
+# CONFIG_NS83820 is not set
+CONFIG_NET_VENDOR_8390=y
+# CONFIG_NE2K_PCI is not set
+CONFIG_NET_VENDOR_NVIDIA=y
+# CONFIG_FORCEDETH is not set
+CONFIG_NET_VENDOR_OKI=y
+# CONFIG_PCH_GBE is not set
+# CONFIG_ETHOC is not set
+CONFIG_NET_PACKET_ENGINE=y
+# CONFIG_HAMACHI is not set
+# CONFIG_YELLOWFIN is not set
+CONFIG_NET_VENDOR_QLOGIC=y
+# CONFIG_QLA3XXX is not set
+# CONFIG_QLCNIC is not set
+# CONFIG_QLGE is not set
+# CONFIG_NETXEN_NIC is not set
+CONFIG_NET_VENDOR_REALTEK=y
+# CONFIG_8139CP is not set
+# CONFIG_8139TOO is not set
+# CONFIG_R8169 is not set
+CONFIG_NET_VENDOR_RDC=y
+# CONFIG_R6040 is not set
+CONFIG_NET_VENDOR_SEEQ=y
+# CONFIG_SEEQ8005 is not set
+CONFIG_NET_VENDOR_SILAN=y
+# CONFIG_SC92031 is not set
+CONFIG_NET_VENDOR_SIS=y
+# CONFIG_SIS900 is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SFC is not set
+CONFIG_NET_VENDOR_SMSC=y
+# CONFIG_EPIC100 is not set
+# CONFIG_SMSC9420 is not set
+CONFIG_NET_VENDOR_STMICRO=y
+# CONFIG_STMMAC_ETH is not set
+CONFIG_NET_VENDOR_SUN=y
+# CONFIG_HAPPYMEAL is not set
+# CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
+# CONFIG_NIU is not set
+CONFIG_NET_VENDOR_TEHUTI=y
+# CONFIG_TEHUTI is not set
+CONFIG_NET_VENDOR_TI=y
+# CONFIG_TLAN is not set
+CONFIG_NET_VENDOR_VIA=y
+# CONFIG_VIA_RHINE is not set
+# CONFIG_VIA_VELOCITY is not set
+CONFIG_NET_VENDOR_WIZNET=y
+# CONFIG_WIZNET_W5100 is not set
+# CONFIG_WIZNET_W5300 is not set
+# CONFIG_FDDI is not set
+# CONFIG_HIPPI is not set
+# CONFIG_NET_SB1000 is not set
+# CONFIG_PHYLIB is not set
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+CONFIG_WLAN=y
+# CONFIG_AIRO is not set
+# CONFIG_ATMEL is not set
+# CONFIG_PRISM54 is not set
+# CONFIG_HOSTAP is not set
+# CONFIG_WL_TI is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+# CONFIG_WAN is not set
+# CONFIG_VMXNET3 is not set
+# CONFIG_ISDN is not set
+
+#
+# Input device support
+#
+CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
+# CONFIG_INPUT_POLLDEV is not set
+# CONFIG_INPUT_SPARSEKMAP is not set
+# CONFIG_INPUT_MATRIXKMAP is not set
+
+#
+# Userland interfaces
+#
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_EVDEV is not set
+# CONFIG_INPUT_EVBUG is not set
+
+#
+# Input Device Drivers
+#
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_KEYBOARD_ATKBD=y
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_OPENCORES is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_OMAP4 is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+CONFIG_INPUT_MOUSE=y
+CONFIG_MOUSE_PS2=y
+CONFIG_MOUSE_PS2_ALPS=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+CONFIG_MOUSE_PS2_LIFEBOOK=y
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_PS2_ELANTECH is not set
+# CONFIG_MOUSE_PS2_SENTELIC is not set
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+# CONFIG_MOUSE_SERIAL is not set
+# CONFIG_MOUSE_APPLETOUCH is not set
+# CONFIG_MOUSE_BCM5974 is not set
+# CONFIG_MOUSE_VSXXXAA is not set
+# CONFIG_MOUSE_SYNAPTICS_USB is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TABLET is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
+
+#
+# Hardware I/O ports
+#
+CONFIG_SERIO=y
+CONFIG_SERIO_I8042=y
+CONFIG_SERIO_SERPORT=y
+# CONFIG_SERIO_CT82C710 is not set
+# CONFIG_SERIO_PCIPS2 is not set
+CONFIG_SERIO_LIBPS2=y
+# CONFIG_SERIO_RAW is not set
+# CONFIG_SERIO_ALTERA_PS2 is not set
+# CONFIG_SERIO_PS2MULT is not set
+# CONFIG_GAMEPORT is not set
+
+#
+# Character devices
+#
+CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_HW_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
+CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=256
+# CONFIG_SERIAL_NONSTANDARD is not set
+# CONFIG_NOZOMI is not set
+# CONFIG_N_GSM is not set
+# CONFIG_TRACE_SINK is not set
+CONFIG_DEVKMEM=y
+
+#
+# Serial drivers
+#
+# CONFIG_SERIAL_8250 is not set
+CONFIG_FIX_EARLYCON_MEM=y
+
+#
+# Non-8250 serial port support
+#
+# CONFIG_SERIAL_MFD_HSU is not set
+# CONFIG_SERIAL_JSM is not set
+# CONFIG_SERIAL_TIMBERDALE is not set
+# CONFIG_SERIAL_ALTERA_JTAGUART is not set
+# CONFIG_SERIAL_ALTERA_UART is not set
+# CONFIG_SERIAL_PCH_UART is not set
+# CONFIG_SERIAL_XILINX_PS_UART is not set
+CONFIG_HVC_DRIVER=y
+CONFIG_VIRTIO_CONSOLE=y
+# CONFIG_IPMI_HANDLER is not set
+# CONFIG_HW_RANDOM is not set
+# CONFIG_NVRAM is not set
+# CONFIG_RTC is not set
+# CONFIG_GEN_RTC is not set
+# CONFIG_R3964 is not set
+# CONFIG_APPLICOM is not set
+# CONFIG_MWAVE is not set
+# CONFIG_RAW_DRIVER is not set
+# CONFIG_HPET is not set
+# CONFIG_HANGCHECK_TIMER is not set
+# CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
+CONFIG_DEVPORT=y
+# CONFIG_I2C is not set
+# CONFIG_SPI is not set
+# CONFIG_HSI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
+
+#
+# PPS generators support
+#
+
+#
+# PTP clock support
+#
+
+#
+# Enable Device Drivers -> PPS to see the PTP clock options.
+#
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+# CONFIG_GPIOLIB is not set
+# CONFIG_W1 is not set
+CONFIG_POWER_SUPPLY=y
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+# CONFIG_PDA_POWER is not set
+# CONFIG_TEST_POWER is not set
+# CONFIG_BATTERY_DS2780 is not set
+# CONFIG_BATTERY_DS2781 is not set
+# CONFIG_BATTERY_BQ27x00 is not set
+# CONFIG_CHARGER_MAX8903 is not set
+# CONFIG_POWER_AVS is not set
+CONFIG_HWMON=y
+# CONFIG_HWMON_VID is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
+
+#
+# Native drivers
+#
+# CONFIG_SENSORS_ABITUGURU is not set
+# CONFIG_SENSORS_ABITUGURU3 is not set
+# CONFIG_SENSORS_K8TEMP is not set
+# CONFIG_SENSORS_K10TEMP is not set
+# CONFIG_SENSORS_FAM15H_POWER is not set
+# CONFIG_SENSORS_I5K_AMB is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_F71882FG is not set
+# CONFIG_SENSORS_CORETEMP is not set
+# CONFIG_SENSORS_IT87 is not set
+# CONFIG_SENSORS_NTC_THERMISTOR is not set
+# CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_SIS5595 is not set
+# CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_SCH56XX_COMMON is not set
+# CONFIG_SENSORS_VIA_CPUTEMP is not set
+# CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83627EHF is not set
+# CONFIG_SENSORS_APPLESMC is not set
+
+#
+# ACPI drivers
+#
+# CONFIG_SENSORS_ACPI_POWER is not set
+# CONFIG_SENSORS_ATK0110 is not set
+CONFIG_THERMAL=y
+CONFIG_THERMAL_HWMON=y
+# CONFIG_WATCHDOG is not set
+CONFIG_SSB_POSSIBLE=y
+
+#
+# Sonics Silicon Backplane
+#
+# CONFIG_SSB is not set
+CONFIG_BCMA_POSSIBLE=y
+
+#
+# Broadcom specific AMBA
+#
+# CONFIG_BCMA is not set
+
+#
+# Multifunction device drivers
+#
+# CONFIG_MFD_CORE is not set
+# CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_ABX500_CORE is not set
+# CONFIG_MFD_CS5535 is not set
+# CONFIG_LPC_SCH is not set
+# CONFIG_LPC_ICH is not set
+# CONFIG_MFD_RDC321X is not set
+# CONFIG_MFD_JANZ_CMODIO is not set
+# CONFIG_MFD_VX855 is not set
+# CONFIG_REGULATOR is not set
+# CONFIG_MEDIA_SUPPORT is not set
+
+#
+# Graphics support
+#
+# CONFIG_AGP is not set
+CONFIG_VGA_ARB=y
+CONFIG_VGA_ARB_MAX_GPUS=16
+# CONFIG_VGA_SWITCHEROO is not set
+# CONFIG_DRM is not set
+# CONFIG_STUB_POULSBO is not set
+# CONFIG_VGASTATE is not set
+# CONFIG_VIDEO_OUTPUT_CONTROL is not set
+# CONFIG_FB is not set
+# CONFIG_EXYNOS_VIDEO is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
+
+#
+# Console display driver support
+#
+CONFIG_VGA_CONSOLE=y
+# CONFIG_VGACON_SOFT_SCROLLBACK is not set
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_SOUND=y
+# CONFIG_SOUND_OSS_CORE is not set
+# CONFIG_SND is not set
+# CONFIG_SOUND_PRIME is not set
+
+#
+# HID support
+#
+CONFIG_HID=y
+# CONFIG_HID_BATTERY_STRENGTH is not set
+# CONFIG_HIDRAW is not set
+# CONFIG_UHID is not set
+CONFIG_HID_GENERIC=y
+
+#
+# Special HID drivers
+#
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
+CONFIG_USB_ARCH_HAS_XHCI=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_ARCH_HAS_HCD=y
+# CONFIG_USB is not set
+
+#
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may
+#
+# CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
+# CONFIG_UWB is not set
+# CONFIG_MMC is not set
+# CONFIG_MEMSTICK is not set
+# CONFIG_NEW_LEDS is not set
+# CONFIG_ACCESSIBILITY is not set
+# CONFIG_INFINIBAND is not set
+# CONFIG_EDAC is not set
+# CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
+# CONFIG_AUXDISPLAY is not set
+# CONFIG_UIO is not set
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_RING=y
+
+#
+# Virtio drivers
+#
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_MMIO=y
+# CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES is not set
+
+#
+# Microsoft Hyper-V guest support
+#
+# CONFIG_HYPERV is not set
+# CONFIG_STAGING is not set
+CONFIG_X86_PLATFORM_DEVICES=y
+# CONFIG_ACERHDF is not set
+# CONFIG_ASUS_LAPTOP is not set
+# CONFIG_FUJITSU_TABLET is not set
+# CONFIG_HP_ACCEL is not set
+# CONFIG_THINKPAD_ACPI is not set
+# CONFIG_SENSORS_HDAPS is not set
+# CONFIG_INTEL_MENLOW is not set
+# CONFIG_ACPI_WMI is not set
+# CONFIG_TOPSTAR_LAPTOP is not set
+# CONFIG_TOSHIBA_BT_RFKILL is not set
+# CONFIG_ACPI_CMPC is not set
+# CONFIG_INTEL_IPS is not set
+# CONFIG_IBM_RTL is not set
+# CONFIG_XO15_EBOOK is not set
+# CONFIG_SAMSUNG_Q10 is not set
+
+#
+# Hardware Spinlock drivers
+#
+CONFIG_CLKEVT_I8253=y
+CONFIG_I8253_LOCK=y
+CONFIG_CLKBLD_I8253=y
+CONFIG_IOMMU_SUPPORT=y
+# CONFIG_AMD_IOMMU is not set
+# CONFIG_INTEL_IOMMU is not set
+# CONFIG_IRQ_REMAP is not set
+
+#
+# Remoteproc drivers (EXPERIMENTAL)
+#
+
+#
+# Rpmsg drivers (EXPERIMENTAL)
+#
+# CONFIG_VIRT_DRIVERS is not set
+# CONFIG_PM_DEVFREQ is not set
+# CONFIG_EXTCON is not set
+# CONFIG_MEMORY is not set
+# CONFIG_IIO is not set
+# CONFIG_VME_BUS is not set
+# CONFIG_PWM is not set
+
+#
+# Firmware Drivers
+#
+# CONFIG_EDD is not set
+CONFIG_FIRMWARE_MEMMAP=y
+# CONFIG_DELL_RBU is not set
+# CONFIG_DCDBAS is not set
+CONFIG_DMIID=y
+# CONFIG_DMI_SYSFS is not set
+# CONFIG_ISCSI_IBFT_FIND is not set
+# CONFIG_GOOGLE_FIRMWARE is not set
+
+#
+# File systems
+#
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT2_FS_XIP is not set
+CONFIG_EXT3_FS=y
+# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
+# CONFIG_EXT3_FS_XATTR is not set
+# CONFIG_EXT4_FS is not set
+CONFIG_JBD=y
+CONFIG_REISERFS_FS=y
+# CONFIG_REISERFS_CHECK is not set
+# CONFIG_REISERFS_PROC_INFO is not set
+# CONFIG_REISERFS_FS_XATTR is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
+# CONFIG_NILFS2_FS is not set
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
+CONFIG_DNOTIFY=y
+CONFIG_INOTIFY_USER=y
+# CONFIG_FANOTIFY is not set
+CONFIG_QUOTA=y
+# CONFIG_QUOTA_NETLINK_INTERFACE is not set
+CONFIG_PRINT_QUOTA_WARNING=y
+# CONFIG_QUOTA_DEBUG is not set
+# CONFIG_QFMT_V1 is not set
+# CONFIG_QFMT_V2 is not set
+CONFIG_QUOTACTL=y
+CONFIG_AUTOFS4_FS=y
+# CONFIG_FUSE_FS is not set
+
+#
+# Caches
+#
+# CONFIG_FSCACHE is not set
+
+#
+# CD-ROM/DVD Filesystems
+#
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+# CONFIG_ZISOFS is not set
+# CONFIG_UDF_FS is not set
+
+#
+# DOS/FAT/NT Filesystems
+#
+# CONFIG_MSDOS_FS is not set
+# CONFIG_VFAT_FS is not set
+# CONFIG_NTFS_FS is not set
+
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_SYSFS=y
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_HUGETLBFS is not set
+# CONFIG_HUGETLB_PAGE is not set
+# CONFIG_CONFIGFS_FS is not set
+CONFIG_MISC_FILESYSTEMS=y
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_LOGFS is not set
+# CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_OMFS_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_QNX6FS_FS is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_PSTORE is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+CONFIG_NETWORK_FILESYSTEMS=y
+# CONFIG_NFS_FS is not set
+# CONFIG_NFSD is not set
+# CONFIG_CEPH_FS is not set
+# CONFIG_CIFS is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+CONFIG_9P_FS=y
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
+# CONFIG_NLS_CODEPAGE_437 is not set
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_ASCII is not set
+# CONFIG_NLS_ISO8859_1 is not set
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_MAC_ROMAN is not set
+# CONFIG_NLS_MAC_CELTIC is not set
+# CONFIG_NLS_MAC_CENTEURO is not set
+# CONFIG_NLS_MAC_CROATIAN is not set
+# CONFIG_NLS_MAC_CYRILLIC is not set
+# CONFIG_NLS_MAC_GAELIC is not set
+# CONFIG_NLS_MAC_GREEK is not set
+# CONFIG_NLS_MAC_ICELAND is not set
+# CONFIG_NLS_MAC_INUIT is not set
+# CONFIG_NLS_MAC_ROMANIAN is not set
+# CONFIG_NLS_MAC_TURKISH is not set
+# CONFIG_NLS_UTF8 is not set
+
+#
+# Kernel hacking
+#
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+# CONFIG_PRINTK_TIME is not set
+CONFIG_DEFAULT_MESSAGE_LOGLEVEL=4
+CONFIG_ENABLE_WARN_DEPRECATED=y
+CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
+# CONFIG_MAGIC_SYSRQ is not set
+# CONFIG_STRIP_ASM_SYMS is not set
+# CONFIG_READABLE_ASM is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
+# CONFIG_DEBUG_SECTION_MISMATCH is not set
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_SHIRQ is not set
+# CONFIG_LOCKUP_DETECTOR is not set
+# CONFIG_HARDLOCKUP_DETECTOR is not set
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_KMEMLEAK is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_SPARSE_RCU_POINTER is not set
+# CONFIG_LOCK_STAT is not set
+# CONFIG_DEBUG_ATOMIC_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_DEBUG_KOBJECT is not set
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_INFO_REDUCED is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_VIRTUAL is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
+CONFIG_DEBUG_MEMORY_INIT=y
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_TEST_LIST_SORT is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_CREDENTIALS is not set
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
+CONFIG_FRAME_POINTER=y
+# CONFIG_BOOT_PRINTK_DELAY is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RCU_TRACE is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+# CONFIG_NOTIFIER_ERROR_INJECTION is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_LATENCYTOP is not set
+# CONFIG_DEBUG_PAGEALLOC is not set
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_C_RECORDMCOUNT=y
+CONFIG_TRACING_SUPPORT=y
+CONFIG_FTRACE=y
+# CONFIG_FUNCTION_TRACER is not set
+# CONFIG_IRQSOFF_TRACER is not set
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_ENABLE_DEFAULT_TRACERS is not set
+# CONFIG_FTRACE_SYSCALLS is not set
+CONFIG_BRANCH_PROFILE_NONE=y
+# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
+# CONFIG_PROFILE_ALL_BRANCHES is not set
+# CONFIG_STACK_TRACER is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_UPROBE_EVENT is not set
+# CONFIG_PROBE_EVENTS is not set
+# CONFIG_MMIOTRACE is not set
+# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
+# CONFIG_DMA_API_DEBUG is not set
+# CONFIG_ATOMIC64_SELFTEST is not set
+# CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
+# CONFIG_KGDB is not set
+CONFIG_HAVE_ARCH_KMEMCHECK=y
+# CONFIG_TEST_KSTRTOX is not set
+# CONFIG_STRICT_DEVMEM is not set
+CONFIG_X86_VERBOSE_BOOTUP=y
+CONFIG_EARLY_PRINTK=y
+# CONFIG_EARLY_PRINTK_DBGP is not set
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_X86_PTDUMP is not set
+CONFIG_DEBUG_RODATA=y
+CONFIG_DEBUG_RODATA_TEST=y
+# CONFIG_DEBUG_TLBFLUSH is not set
+# CONFIG_IOMMU_DEBUG is not set
+# CONFIG_IOMMU_STRESS is not set
+CONFIG_HAVE_MMIOTRACE_SUPPORT=y
+CONFIG_IO_DELAY_TYPE_0X80=0
+CONFIG_IO_DELAY_TYPE_0XED=1
+CONFIG_IO_DELAY_TYPE_UDELAY=2
+CONFIG_IO_DELAY_TYPE_NONE=3
+CONFIG_IO_DELAY_0X80=y
+# CONFIG_IO_DELAY_0XED is not set
+# CONFIG_IO_DELAY_UDELAY is not set
+# CONFIG_IO_DELAY_NONE is not set
+CONFIG_DEFAULT_IO_DELAY_TYPE=0
+# CONFIG_CPA_DEBUG is not set
+# CONFIG_OPTIMIZE_INLINING is not set
+# CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set
+# CONFIG_DEBUG_NMI_SELFTEST is not set
+
+#
+# Security options
+#
+# CONFIG_KEYS is not set
+# CONFIG_SECURITY_DMESG_RESTRICT is not set
+# CONFIG_SECURITY is not set
+# CONFIG_SECURITYFS is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY=""
+CONFIG_CRYPTO=y
+
+#
+# Crypto core or helper
+#
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_PCOMP=y
+CONFIG_CRYPTO_PCOMP2=y
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_USER=y
+CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
+CONFIG_CRYPTO_GF128MUL=y
+CONFIG_CRYPTO_NULL=y
+CONFIG_CRYPTO_WORKQUEUE=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_AUTHENC=y
+CONFIG_CRYPTO_ABLK_HELPER_X86=y
+CONFIG_CRYPTO_GLUE_HELPER_X86=y
+
+#
+# Authenticated Encryption with Associated Data
+#
+CONFIG_CRYPTO_CCM=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_SEQIV=y
+
+#
+# Block modes
+#
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTR=y
+# CONFIG_CRYPTO_CTS is not set
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_LRW=y
+CONFIG_CRYPTO_PCBC=y
+CONFIG_CRYPTO_XTS=y
+
+#
+# Hash modes
+#
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_XCBC=y
+# CONFIG_CRYPTO_VMAC is not set
+
+#
+# Digest
+#
+CONFIG_CRYPTO_CRC32C=y
+# CONFIG_CRYPTO_CRC32C_INTEL is not set
+CONFIG_CRYPTO_GHASH=y
+CONFIG_CRYPTO_MD4=y
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_MICHAEL_MIC=y
+CONFIG_CRYPTO_RMD128=y
+CONFIG_CRYPTO_RMD160=y
+CONFIG_CRYPTO_RMD256=y
+CONFIG_CRYPTO_RMD320=y
+CONFIG_CRYPTO_SHA1=y
+# CONFIG_CRYPTO_SHA1_SSSE3 is not set
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_TGR192=y
+CONFIG_CRYPTO_WP512=y
+# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set
+
+#
+# Ciphers
+#
+CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_AES_X86_64 is not set
+# CONFIG_CRYPTO_AES_NI_INTEL is not set
+CONFIG_CRYPTO_ANUBIS=y
+CONFIG_CRYPTO_ARC4=y
+CONFIG_CRYPTO_BLOWFISH=y
+CONFIG_CRYPTO_BLOWFISH_COMMON=y
+# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set
+CONFIG_CRYPTO_CAMELLIA=y
+# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set
+CONFIG_CRYPTO_CAST5=y
+CONFIG_CRYPTO_CAST6=y
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_FCRYPT=y
+CONFIG_CRYPTO_KHAZAD=y
+CONFIG_CRYPTO_SALSA20=y
+# CONFIG_CRYPTO_SALSA20_X86_64 is not set
+CONFIG_CRYPTO_SEED=y
+CONFIG_CRYPTO_SERPENT=y
+# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set
+CONFIG_CRYPTO_SERPENT_AVX_X86_64=y
+CONFIG_CRYPTO_TEA=y
+CONFIG_CRYPTO_TWOFISH=y
+CONFIG_CRYPTO_TWOFISH_COMMON=y
+CONFIG_CRYPTO_TWOFISH_X86_64=y
+CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=y
+CONFIG_CRYPTO_TWOFISH_AVX_X86_64=y
+
+#
+# Compression
+#
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_ZLIB=y
+# CONFIG_CRYPTO_LZO is not set
+
+#
+# Random Number Generation
+#
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_USER_API=y
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+# CONFIG_CRYPTO_HW is not set
+CONFIG_HAVE_KVM=y
+CONFIG_VIRTUALIZATION=y
+# CONFIG_KVM is not set
+# CONFIG_VHOST_NET is not set
+# CONFIG_BINARY_PRINTF is not set
+
+#
+# Library routines
+#
+CONFIG_BITREVERSE=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IO=y
+CONFIG_CRC_CCITT=y
+CONFIG_CRC16=y
+# CONFIG_CRC_T10DIF is not set
+CONFIG_CRC_ITU_T=y
+CONFIG_CRC32=y
+# CONFIG_CRC32_SELFTEST is not set
+CONFIG_CRC32_SLICEBY8=y
+# CONFIG_CRC32_SLICEBY4 is not set
+# CONFIG_CRC32_SARWATE is not set
+# CONFIG_CRC32_BIT is not set
+CONFIG_CRC7=y
+CONFIG_LIBCRC32C=y
+# CONFIG_CRC8 is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
+# CONFIG_XZ_DEC is not set
+# CONFIG_XZ_DEC_BCJ is not set
+CONFIG_TEXTSEARCH=y
+CONFIG_TEXTSEARCH_KMP=y
+CONFIG_TEXTSEARCH_BM=y
+CONFIG_TEXTSEARCH_FSM=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAS_DMA=y
+CONFIG_DQL=y
+CONFIG_NLATTR=y
+CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE=y
+# CONFIG_AVERAGE is not set
+# CONFIG_CORDIC is not set
+# CONFIG_DDR is not set
diff --git a/testing/config/kvm/alice.xml b/testing/config/kvm/alice.xml
new file mode 100644
index 000000000..6ca78f861
--- /dev/null
+++ b/testing/config/kvm/alice.xml
@@ -0,0 +1,70 @@
+<domain type='kvm'>
+ <name>alice</name>
+ <uuid>1f35c25d-6a7b-4ee1-2461-d7e530e7b2a9</uuid>
+ <memory unit='KiB'>131072</memory>
+ <currentMemory unit='KiB'>131072</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-1.1'>hvm</type>
+ <kernel>/var/run/kvm-swan-kernel</kernel>
+ <cmdline>root=/dev/vda1 loglevel=1</cmdline>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <pae/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>restart</on_crash>
+ <devices>
+ <emulator>/usr/bin/kvm</emulator>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='writethrough'/>
+ <source file='/var/lib/libvirt/images/alice.qcow2'/>
+ <target dev='vda' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <filesystem type='mount' accessmode='mapped'>
+ <source dir='/var/run/kvm-swan-hostfs'/>
+ <target dir='/hostshare'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </filesystem>
+ <interface type='network'>
+ <mac address='52:54:00:9a:e2:de'/>
+ <source network='vnet2'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </interface>
+ <interface type='network'>
+ <mac address='52:54:00:3b:0c:d7'/>
+ <source network='vnet1'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
+ </interface>
+ <serial type='pty'>
+ <target port='0'/>
+ </serial>
+ <console type='pty'>
+ <target type='serial' port='0'/>
+ </console>
+ <input type='tablet' bus='usb'/>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ <sound model='ich6'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </sound>
+ <video>
+ <model type='cirrus' vram='9216' heads='1'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </video>
+ <memballoon model='virtio'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </memballoon>
+ </devices>
+</domain>
diff --git a/testing/config/kvm/bob.xml b/testing/config/kvm/bob.xml
new file mode 100644
index 000000000..d9a9b4c05
--- /dev/null
+++ b/testing/config/kvm/bob.xml
@@ -0,0 +1,64 @@
+<domain type='kvm'>
+ <name>bob</name>
+ <uuid>72728516-377f-f5be-ea1d-b1f1e851538f</uuid>
+ <memory unit='KiB'>131072</memory>
+ <currentMemory unit='KiB'>131072</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-1.1'>hvm</type>
+ <kernel>/var/run/kvm-swan-kernel</kernel>
+ <cmdline>root=/dev/vda1 loglevel=1</cmdline>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <pae/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>restart</on_crash>
+ <devices>
+ <emulator>/usr/bin/kvm</emulator>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='writethrough'/>
+ <source file='/var/lib/libvirt/images/bob.qcow2'/>
+ <target dev='vda' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <filesystem type='mount' accessmode='mapped'>
+ <source dir='/var/run/kvm-swan-hostfs'/>
+ <target dir='/hostshare'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </filesystem>
+ <interface type='network'>
+ <mac address='52:54:00:40:85:6b'/>
+ <source network='vnet3'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </interface>
+ <serial type='pty'>
+ <target port='0'/>
+ </serial>
+ <console type='pty'>
+ <target type='serial' port='0'/>
+ </console>
+ <input type='tablet' bus='usb'/>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ <sound model='ich6'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </sound>
+ <video>
+ <model type='cirrus' vram='9216' heads='1'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </video>
+ <memballoon model='virtio'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </memballoon>
+ </devices>
+</domain>
diff --git a/testing/config/kvm/carol.xml b/testing/config/kvm/carol.xml
new file mode 100644
index 000000000..fbdabe2e4
--- /dev/null
+++ b/testing/config/kvm/carol.xml
@@ -0,0 +1,64 @@
+<domain type='kvm'>
+ <name>carol</name>
+ <uuid>6bc2eef5-7faf-cde0-5f27-6fc29f93bc3d</uuid>
+ <memory unit='KiB'>131072</memory>
+ <currentMemory unit='KiB'>131072</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-1.1'>hvm</type>
+ <kernel>/var/run/kvm-swan-kernel</kernel>
+ <cmdline>root=/dev/vda1 loglevel=1</cmdline>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <pae/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>restart</on_crash>
+ <devices>
+ <emulator>/usr/bin/kvm</emulator>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='writethrough'/>
+ <source file='/var/lib/libvirt/images/carol.qcow2'/>
+ <target dev='vda' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <filesystem type='mount' accessmode='mapped'>
+ <source dir='/var/run/kvm-swan-hostfs'/>
+ <target dir='/hostshare'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </filesystem>
+ <interface type='network'>
+ <mac address='52:54:00:ae:f1:f8'/>
+ <source network='vnet1'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </interface>
+ <serial type='pty'>
+ <target port='0'/>
+ </serial>
+ <console type='pty'>
+ <target type='serial' port='0'/>
+ </console>
+ <input type='tablet' bus='usb'/>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ <sound model='ich6'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </sound>
+ <video>
+ <model type='cirrus' vram='9216' heads='1'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </video>
+ <memballoon model='virtio'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </memballoon>
+ </devices>
+</domain>
diff --git a/testing/config/kvm/dave.xml b/testing/config/kvm/dave.xml
new file mode 100644
index 000000000..bfebe9b60
--- /dev/null
+++ b/testing/config/kvm/dave.xml
@@ -0,0 +1,64 @@
+<domain type='kvm'>
+ <name>dave</name>
+ <uuid>05f1debe-4e38-4f3d-10a0-c07fbb70d816</uuid>
+ <memory unit='KiB'>131072</memory>
+ <currentMemory unit='KiB'>131072</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-1.1'>hvm</type>
+ <kernel>/var/run/kvm-swan-kernel</kernel>
+ <cmdline>root=/dev/vda1 loglevel=1</cmdline>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <pae/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>restart</on_crash>
+ <devices>
+ <emulator>/usr/bin/kvm</emulator>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='writethrough'/>
+ <source file='/var/lib/libvirt/images/dave.qcow2'/>
+ <target dev='vda' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <filesystem type='mount' accessmode='mapped'>
+ <source dir='/var/run/kvm-swan-hostfs'/>
+ <target dir='/hostshare'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </filesystem>
+ <interface type='network'>
+ <mac address='52:54:00:b9:15:a9'/>
+ <source network='vnet1'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </interface>
+ <serial type='pty'>
+ <target port='0'/>
+ </serial>
+ <console type='pty'>
+ <target type='serial' port='0'/>
+ </console>
+ <input type='tablet' bus='usb'/>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ <sound model='ich6'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </sound>
+ <video>
+ <model type='cirrus' vram='9216' heads='1'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </video>
+ <memballoon model='virtio'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </memballoon>
+ </devices>
+</domain>
diff --git a/testing/config/kvm/moon.xml b/testing/config/kvm/moon.xml
new file mode 100644
index 000000000..e019fcea5
--- /dev/null
+++ b/testing/config/kvm/moon.xml
@@ -0,0 +1,70 @@
+<domain type='kvm'>
+ <name>moon</name>
+ <uuid>b5e00ad3-1c81-3b2a-7f66-cdf8727b3c65</uuid>
+ <memory unit='KiB'>131072</memory>
+ <currentMemory unit='KiB'>131072</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-1.1'>hvm</type>
+ <kernel>/var/run/kvm-swan-kernel</kernel>
+ <cmdline>root=/dev/vda1 loglevel=1</cmdline>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <pae/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>restart</on_crash>
+ <devices>
+ <emulator>/usr/bin/kvm</emulator>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='writethrough'/>
+ <source file='/var/lib/libvirt/images/moon.qcow2'/>
+ <target dev='vda' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <filesystem type='mount' accessmode='mapped'>
+ <source dir='/var/run/kvm-swan-hostfs'/>
+ <target dir='/hostshare'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </filesystem>
+ <interface type='network'>
+ <mac address='52:54:00:43:e3:35'/>
+ <source network='vnet2'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
+ </interface>
+ <interface type='network'>
+ <mac address='52:54:00:c7:b8:b0'/>
+ <source network='vnet1'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </interface>
+ <serial type='pty'>
+ <target port='0'/>
+ </serial>
+ <console type='pty'>
+ <target type='serial' port='0'/>
+ </console>
+ <input type='tablet' bus='usb'/>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ <sound model='ich6'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </sound>
+ <video>
+ <model type='cirrus' vram='9216' heads='1'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </video>
+ <memballoon model='virtio'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </memballoon>
+ </devices>
+</domain>
diff --git a/testing/config/kvm/sun.xml b/testing/config/kvm/sun.xml
new file mode 100644
index 000000000..5ed1a47ea
--- /dev/null
+++ b/testing/config/kvm/sun.xml
@@ -0,0 +1,70 @@
+<domain type='kvm'>
+ <name>sun</name>
+ <uuid>35341843-346c-a63a-786b-9df0fd5e6264</uuid>
+ <memory unit='KiB'>131072</memory>
+ <currentMemory unit='KiB'>131072</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-1.1'>hvm</type>
+ <kernel>/var/run/kvm-swan-kernel</kernel>
+ <cmdline>root=/dev/vda1 loglevel=1</cmdline>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <pae/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>restart</on_crash>
+ <devices>
+ <emulator>/usr/bin/kvm</emulator>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='writethrough'/>
+ <source file='/var/lib/libvirt/images/sun.qcow2'/>
+ <target dev='vda' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <filesystem type='mount' accessmode='mapped'>
+ <source dir='/var/run/kvm-swan-hostfs'/>
+ <target dir='/hostshare'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </filesystem>
+ <interface type='network'>
+ <mac address='52:54:00:77:43:ea'/>
+ <source network='vnet1'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </interface>
+ <interface type='network'>
+ <mac address='52:54:00:0f:97:db'/>
+ <source network='vnet3'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
+ </interface>
+ <serial type='pty'>
+ <target port='0'/>
+ </serial>
+ <console type='pty'>
+ <target type='serial' port='0'/>
+ </console>
+ <input type='tablet' bus='usb'/>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ <sound model='ich6'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </sound>
+ <video>
+ <model type='cirrus' vram='9216' heads='1'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </video>
+ <memballoon model='virtio'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </memballoon>
+ </devices>
+</domain>
diff --git a/testing/config/kvm/venus.xml b/testing/config/kvm/venus.xml
new file mode 100644
index 000000000..77a333655
--- /dev/null
+++ b/testing/config/kvm/venus.xml
@@ -0,0 +1,64 @@
+<domain type='kvm'>
+ <name>venus</name>
+ <uuid>f0838df9-7cc0-84f5-6c14-2d16ab002e8d</uuid>
+ <memory unit='KiB'>131072</memory>
+ <currentMemory unit='KiB'>131072</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-1.1'>hvm</type>
+ <kernel>/var/run/kvm-swan-kernel</kernel>
+ <cmdline>root=/dev/vda1 loglevel=1</cmdline>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <pae/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>restart</on_crash>
+ <devices>
+ <emulator>/usr/bin/kvm</emulator>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='writethrough'/>
+ <source file='/var/lib/libvirt/images/venus.qcow2'/>
+ <target dev='vda' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <filesystem type='mount' accessmode='mapped'>
+ <source dir='/var/run/kvm-swan-hostfs'/>
+ <target dir='/hostshare'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </filesystem>
+ <interface type='network'>
+ <mac address='52:54:00:69:d3:80'/>
+ <source network='vnet2'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </interface>
+ <serial type='pty'>
+ <target port='0'/>
+ </serial>
+ <console type='pty'>
+ <target type='serial' port='0'/>
+ </console>
+ <input type='tablet' bus='usb'/>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ <sound model='ich6'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </sound>
+ <video>
+ <model type='cirrus' vram='9216' heads='1'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </video>
+ <memballoon model='virtio'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </memballoon>
+ </devices>
+</domain>
diff --git a/testing/config/kvm/vnet1.xml b/testing/config/kvm/vnet1.xml
new file mode 100644
index 000000000..f9d979be1
--- /dev/null
+++ b/testing/config/kvm/vnet1.xml
@@ -0,0 +1,11 @@
+<network>
+ <name>vnet1</name>
+ <uuid>1d6ac7c7-60d9-56c1-a7df-210d3d0cc6d1</uuid>
+ <forward dev='lo' mode='route'>
+ <interface dev='lo'/>
+ </forward>
+ <bridge name='virbr1' stp='on' delay='0' />
+ <mac address='52:54:00:97:F9:FD'/>
+ <ip address='192.168.0.254' netmask='255.255.255.0'>
+ </ip>
+</network>
diff --git a/testing/config/kvm/vnet2.xml b/testing/config/kvm/vnet2.xml
new file mode 100644
index 000000000..7d125bfc6
--- /dev/null
+++ b/testing/config/kvm/vnet2.xml
@@ -0,0 +1,11 @@
+<network>
+ <name>vnet2</name>
+ <uuid>b5147a7d-e184-5c9e-3838-4621796ba95c</uuid>
+ <forward dev='lo' mode='route'>
+ <interface dev='lo'/>
+ </forward>
+ <bridge name='virbr2' stp='on' delay='0' />
+ <mac address='52:54:00:05:F3:34'/>
+ <ip address='10.1.0.254' netmask='255.255.0.0'>
+ </ip>
+</network>
diff --git a/testing/config/kvm/vnet3.xml b/testing/config/kvm/vnet3.xml
new file mode 100644
index 000000000..1da06c448
--- /dev/null
+++ b/testing/config/kvm/vnet3.xml
@@ -0,0 +1,11 @@
+<network>
+ <name>vnet3</name>
+ <uuid>5c537abc-c116-90e9-a0ef-886340d4c356</uuid>
+ <forward dev='lo' mode='route'>
+ <interface dev='lo'/>
+ </forward>
+ <bridge name='virbr3' stp='on' delay='0' />
+ <mac address='52:54:00:62:4C:69'/>
+ <ip address='10.2.0.254' netmask='255.255.0.0'>
+ </ip>
+</network>
diff --git a/testing/config/kvm/winnetou.xml b/testing/config/kvm/winnetou.xml
new file mode 100644
index 000000000..99d5deb99
--- /dev/null
+++ b/testing/config/kvm/winnetou.xml
@@ -0,0 +1,64 @@
+<domain type='kvm'>
+ <name>winnetou</name>
+ <uuid>b1d3d2f7-e20b-ab95-277e-66d4cac33cc3</uuid>
+ <memory unit='KiB'>131072</memory>
+ <currentMemory unit='KiB'>131072</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-1.1'>hvm</type>
+ <kernel>/var/run/kvm-swan-kernel</kernel>
+ <cmdline>root=/dev/vda1 loglevel=1</cmdline>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ <pae/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>restart</on_crash>
+ <devices>
+ <emulator>/usr/bin/kvm</emulator>
+ <disk type='file' device='disk'>
+ <driver name='qemu' type='qcow2' cache='writethrough'/>
+ <source file='/var/lib/libvirt/images/winnetou.qcow2'/>
+ <target dev='vda' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <filesystem type='mount' accessmode='mapped'>
+ <source dir='/var/run/kvm-swan-hostfs'/>
+ <target dir='/hostshare'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </filesystem>
+ <interface type='network'>
+ <mac address='52:54:00:4b:23:fa'/>
+ <source network='vnet1'/>
+ <model type='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </interface>
+ <serial type='pty'>
+ <target port='0'/>
+ </serial>
+ <console type='pty'>
+ <target type='serial' port='0'/>
+ </console>
+ <input type='tablet' bus='usb'/>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ <sound model='ich6'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </sound>
+ <video>
+ <model type='cirrus' vram='9216' heads='1'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+ </video>
+ <memballoon model='virtio'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </memballoon>
+ </devices>
+</domain>
diff --git a/testing/do-tests.in b/testing/do-tests
index 82e027078..fafbe6e89 100755
--- a/testing/do-tests.in
+++ b/testing/do-tests
@@ -14,23 +14,16 @@
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
-DIR=`dirname $0`
+DIR=$(dirname `readlink -f $0`)
+. $DIR/testing.conf
+. $DIR/scripts/function.sh
-source $DIR/scripts/function.sh
-
-[ -f $DIR/testing.conf ] || die "Configuration file 'testing.conf' not found"
[ -d $DIR/hosts ] || die "Directory 'hosts' not found"
[ -d $DIR/tests ] || die "Directory 'tests' not found"
+[ -d $BUILDDIR ] ||
+ die "Directory '$BUILDDIR' does not exist, please run make-testing first"
-source $DIR/testing.conf
-
-
-##############################################################################
-# test if UMLs have been built at all
-#
-
-[ -d $BUILDDIR ] || die "Directory '$BUILDDIR' does not exist. Please run 'make-testing'first."
-
+ln -sfT $DIR $TESTDIR/testing
##############################################################################
# take care of new path and file variables
@@ -38,15 +31,15 @@ source $DIR/testing.conf
[ -d $TESTRESULTSDIR ] || mkdir $TESTRESULTSDIR
-TESTDATE=`date +%Y%m%d-%H%M`
+TESTDATE=`date +%Y%m%d-%H%M-%S`
TODAYDIR=$TESTRESULTSDIR/$TESTDATE
mkdir $TODAYDIR
TESTRESULTSHTML=$TODAYDIR/all.html
INDEX=$TODAYDIR/index.html
-DEFAULTTESTSDIR=$UMLTESTDIR/testing/tests
+DEFAULTTESTSDIR=$TESTDIR/testing/tests
-SOURCEIP_ROUTING_TABLE=@routing_table@
+SOURCEIP_ROUTING_TABLE=220
testnumber="0"
failed_cnt="0"
@@ -105,8 +98,9 @@ done
#
for host in $STRONGSWANHOSTS
do
- ssh $SSHCONF -N root@`eval echo \\\$ipv4_$host` &
+ ssh $SSHCONF -N root@`eval echo \\\$ipv4_$host` >/dev/null 2>&1 &
eval ssh_pid_$host="`echo $!`"
+ do_on_exit kill `eval echo \\\$ssh_pid_$host`
done
@@ -114,30 +108,27 @@ done
# create header for the results html file
#
-KERNEL_VERSION=`basename $KERNEL .tar.bz2`
-IPSEC_VERSION=`basename $STRONGSWAN .tar.bz2`
-
ENVIRONMENT_HEADER=$(cat <<@EOF
- <table border="0" cellspacing="2">
+ <table border="0" cellspacing="2" cellpadding="2">
<tr valign="top">
- <td><b>Host:</b></td>
+ <td><b>Host</b></td>
<td colspan="3">`uname -a`</td>
</tr>
<tr valign="top">
- <td><b>UML kernel: &nbsp;</b></td>
- <td colspan="3">$KERNEL_VERSION</td>
+ <td><b>Guest kernel</b></td>
+ <td colspan="3">$KERNELVERSION</td>
</tr>
<tr valign="top">
- <td><b>IPsec:</b></td>
- <td colspan="3">$IPSEC_VERSION</td>
+ <td><b>strongSwan</b></td>
+ <td colspan="3">$SWANVERSION</td>
</tr>
<tr valign="top">
- <td><b>Date:</b></td>
+ <td><b>Date</b></td>
<td colspan="3">$TESTDATE</td>
</tr>
<tr>
<td width="100">&nbsp;</td>
- <td width="200">&nbsp;</td>
+ <td width="300">&nbsp;</td>
<td width=" 50">&nbsp;</td>
<td >&nbsp;</td>
</tr>
@@ -147,20 +138,20 @@ ENVIRONMENT_HEADER=$(cat <<@EOF
cat > $INDEX <<@EOF
<html>
<head>
- <title>strongSwan UML Tests</title>
+ <title>strongSwan KVM Tests</title>
</head>
<body>
- <h2>strongSwan UML Tests</h2>
+ <h2>strongSwan KVM Tests</h2>
$ENVIRONMENT_HEADER
@EOF
cat > $TESTRESULTSHTML <<@EOF
<html>
<head>
- <title>strongSwan UML Tests - All Tests</title>
+ <title>strongSwan KVM Tests - All Tests</title>
</head>
<body>
- <div><a href="index.html">strongSwan UML Tests</a> / All Tests</div>
+ <div><a href="index.html">strongSwan KVM Tests</a> / All Tests</div>
<h2>All Tests</h2>
$ENVIRONMENT_HEADER
<tr align="left">
@@ -170,10 +161,10 @@ cat > $TESTRESULTSHTML <<@EOF
</tr>
@EOF
-cecho "UML kernel: $KERNEL_VERSION"
-cecho "IPsec: $IPSEC_VERSION"
-cecho "Date: $TESTDATE"
-cecho ""
+echo "Guest kernel : $KERNELVERSION"
+echo "strongSwan : $SWANVERSION"
+echo "Date : $TESTDATE"
+echo
##############################################################################
@@ -183,10 +174,6 @@ cecho ""
if [ $# -gt 0 ]
then
TESTS=$*
-elif [ $SELECTEDTESTSONLY = "yes" ]
-then
- # set internal field seperator
- TESTS=$SELECTEDTESTS
else
# set internal field seperator
TESTS="`ls $DEFAULTTESTSDIR`"
@@ -208,7 +195,7 @@ do
mkdir $TODAYDIR/$SUBDIR
if [ $testnumber == 0 ]
then
- FIRST="<b>Category:</b"
+ FIRST="<b>Category</b>"
else
FIRST="&nbsp;"
fi
@@ -225,24 +212,24 @@ do
<title>strongSwan $SUBDIR Tests</title>
</head>
<body>
- <div><a href="../index.html">strongSwan UML Tests</a> / $SUBDIR</div>
+ <div><a href="../index.html">strongSwan KVM Tests</a> / $SUBDIR</div>
<h2>strongSwan $SUBDIR Tests</h2>
- <table border="0" cellspacing="2">
+ <table border="0" cellspacing="2" cellpadding="2">
<tr valign="top">
- <td><b>UML kernel: &nbsp;</b></td>
- <td colspan="3">$KERNEL_VERSION</td>
+ <td><b>Guest kernel</b></td>
+ <td colspan="3">$KERNELVERSION</td>
</tr>
<tr valign="top">
- <td><b>IPsec:</b></td>
- <td colspan="3">$IPSEC_VERSION</td>
+ <td><b>strongSwan</b></td>
+ <td colspan="3">$SWANVERSION</td>
</tr>
<tr valign="top">
- <td><b>Date:</b></td>
+ <td><b>Date</b></td>
<td colspan="3">$TESTDATE</td>
</tr>
<tr>
<td width="100">&nbsp;</td>
- <td width="200">&nbsp;</td>
+ <td width="300">&nbsp;</td>
<td width=" 50">&nbsp;</td>
<td >&nbsp;</td>
</tr>
@@ -258,11 +245,11 @@ do
do
let "testnumber += 1"
testname=$SUBDIR/$name
- cecho-n " $testnumber $testname.."
+ log_action " $testnumber $testname:"
if [ ! -d $DEFAULTTESTSDIR/${testname} ]
then
- cecho "is missing..skipped"
+ echo "is missing..skipped"
continue
fi
@@ -390,7 +377,7 @@ do
# execute pre-test commands
#
- cecho-n "pre.."
+ echo -n "pre.."
echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1
eval `awk -F "::" '{
@@ -419,7 +406,7 @@ do
# get and evaluate test results
#
- cecho-n "test.."
+ echo -n "test.."
echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1
STATUS="passed"
@@ -476,7 +463,7 @@ do
<body>
<table border="0" cellpadding="0" cellspacing="0" width="600">
<tr><td>
- <div><a href="../../index.html">strongSwan UML Tests</a> / <a href="../index.html">$SUBDIR</a> / $name</div>
+ <div><a href="../../index.html">strongSwan KVM Tests</a> / <a href="../index.html">$SUBDIR</a> / $name</div>
<h2>Test $testname</h2>
<h3>Description</h3>
@EOF
@@ -487,7 +474,7 @@ do
<ul>
<li><a href="console.log">console.log</a></li>
</ul>
- <img src="../../images/$DIAGRAM" alt="$UMLHOSTS">
+ <img src="../../images/$DIAGRAM" alt="$VIRTHOSTS">
@EOF
for host in $IPSECHOSTS
@@ -507,7 +494,7 @@ do
done
scp $SSHCONF $HOSTLOGIN:/etc/ipsec.d/ipsec.sql \
- $TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1
+ $TESTRESULTDIR/${host}.ipsec.sql > /dev/null 2>&1
ssh $SSHCONF $HOSTLOGIN ip -s xfrm policy \
> $TESTRESULTDIR/${host}.ip.policy 2>/dev/null
@@ -558,15 +545,18 @@ do
for file in clients.conf eap.conf radiusd.conf proxy.conf users
do
- scp $SSHCONF $HOSTLOGIN:/etc/raddb/$file \
+ scp $SSHCONF $HOSTLOGIN:/etc/freeradius/$file \
$TESTRESULTDIR/${host}.$file > /dev/null 2>&1
done
scp $SSHCONF $HOSTLOGIN:/etc/strongswan.conf \
$TESTRESULTDIR/${host}.strongswan.conf > /dev/null 2>&1
- scp $SSHCONF $HOSTLOGIN:/var/log/radius/radius.log \
- $TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1
+ scp $SSHCONF $HOSTLOGIN:/var/log/freeradius/radius.log \
+ $TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1
+
+ ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \
+ >> $TESTRESULTDIR/${host}.daemon.log
chmod a+r $TESTRESULTDIR/*
cat >> $TESTRESULTDIR/index.html <<@EOF
@@ -600,6 +590,28 @@ do
done
cat >> $TESTRESULTDIR/index.html <<@EOF
+ <h3>tcpdump</h3>
+ <ul>
+@EOF
+
+ for host in $TCPDUMPHOSTS
+ do
+ eval HOSTLOGIN=root@\$ipv4_${host}
+
+ scp $SSHCONF $HOSTLOGIN:/tmp/tcpdump.log \
+ $TESTRESULTDIR/${host}.tcpdump.log > /dev/null 2>&1
+
+ cat >> $TESTRESULTDIR/index.html <<@EOF
+ <li><a href="$host.tcpdump.log">$host tcpdump.log</a></li>
+@EOF
+
+ done
+
+ cat >> $TESTRESULTDIR/index.html <<@EOF
+ </ul>
+@EOF
+
+ cat >> $TESTRESULTDIR/index.html <<@EOF
</td></tr>
</table>
</body>
@@ -611,7 +623,7 @@ do
# execute post-test commands
#
- cecho-n "post.."
+ echo -n "post"
echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1
eval `awk -F "::" '{
@@ -649,18 +661,6 @@ do
##########################################################################
- # get a copy of /var/log/daemon.log
- #
-
- for host in $RADIUSHOSTS
- do
- eval HOSTLOGIN=root@\$ipv4_${host}
- ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \
- >> $TESTRESULTDIR/${host}.daemon.log
- done
-
-
- ##########################################################################
# stop tcpdump if necessary
#
@@ -688,11 +688,11 @@ do
if [ $STATUS = "passed" ]
then
- COLOR="green"
- cecho "\033[1;32m$STATUS"
+ COLOR="green"
+ log_status 0
else
- COLOR="red"
- cecho "$STATUS"
+ COLOR="red"
+ log_status 1
fi
cat >> $TESTRESULTSHTML << @EOF
@@ -737,10 +737,10 @@ cat >> $TESTRESULTSHTML << @EOF
<td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td>
</tr>
<tr>
- <td><b>Passed:</b></td><td><b><font color="green">$passed_cnt</font></b></td><td>&nbsp;</td><td>&nbsp;</td>
+ <td><b>Passed</b></td><td><b><font color="green">$passed_cnt</font></b></td><td>&nbsp;</td><td>&nbsp;</td>
</tr>
<tr>
- <td><b>Failed:</b></td><td><b><font color="red">$failed_cnt</font></b></td><td>&nbsp;</td><td>&nbsp;</td>
+ <td><b>Failed</b></td><td><b><font color="red">$failed_cnt</font></b></td><td>&nbsp;</td><td>&nbsp;</td>
</tr>
</table>
</body>
@@ -757,7 +757,7 @@ cat >> $INDEX << @EOF
<td>&nbsp;</td>
</tr>
<tr>
- <td><b>Failed:</b></td>
+ <td><b>Failed</b></td>
<td>&nbsp;</td>
<td align="right"><b><font color="red">$failed_cnt</font></b></td>
<td>&nbsp;</td>
@@ -767,33 +767,25 @@ cat >> $INDEX << @EOF
</html>
@EOF
-cecho ""
-cecho "\033[1;32mPassed: $passed_cnt"
-cecho "Failed: $failed_cnt"
-cecho ""
+echo
+echo_ok "Passed : $passed_cnt"
+echo_failed "Failed : $failed_cnt"
+echo
##############################################################################
# copy the test results to the apache server
#
-HTDOCS="/var/www/localhost/htdocs"
+HTDOCS="/var/www"
-cecho-n "Copying test results to winnetou.."
ssh $SSHCONF root@${ipv4_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1
scp $SSHCONF -r $TODAYDIR root@${ipv4_winnetou}:$HTDOCS/testresults > /dev/null 2>&1
ssh $SSHCONF root@${ipv4_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1
-cgecho "done"
-cecho ""
-cecho "The results are available in $TODAYDIR"
-cecho "or via the link http://$ipv4_winnetou/testresults/$TESTDATE"
-
-
-##########################################################################
-# close ssh sessions
-#
-for host in $STRONGSWANHOSTS
-do
- kill `eval echo \\\$ssh_pid_$host`
-done
+echo
+echo "The results are available in $TODAYDIR"
+echo "or via the link http://$ipv4_winnetou/testresults/$TESTDATE"
+ENDDATE=`date +%Y%m%d-%H%M`
+echo
+echo "Finished : $ENDDATE"
diff --git a/testing/hosts/alice/etc/conf.d/hostname b/testing/hosts/alice/etc/conf.d/hostname
deleted file mode 100644
index 2012e0451..000000000
--- a/testing/hosts/alice/etc/conf.d/hostname
+++ /dev/null
@@ -1 +0,0 @@
-HOSTNAME=alice
diff --git a/testing/hosts/alice/etc/conf.d/net b/testing/hosts/alice/etc/conf.d/net
deleted file mode 100644
index 41e8887c4..000000000
--- a/testing/hosts/alice/etc/conf.d/net
+++ /dev/null
@@ -1,12 +0,0 @@
-# /etc/conf.d/net:
-
-# This is basically the ifconfig argument without the ifconfig $iface
-#
-config_eth0=( "PH_IP_ALICE broadcast 10.1.255.255 netmask 255.255.0.0"
- "PH_IP6_ALICE/16" )
-config_eth1=( "PH_IP_ALICE1 broadcast 192.168.0.255 netmask 255.255.255.0"
- "PH_IP6_ALICE1/16" )
-
-# For setting the default gateway
-#
-routes_eth0=( "default via PH_IP_MOON1" )
diff --git a/testing/hosts/alice/etc/freeradius/clients.conf b/testing/hosts/alice/etc/freeradius/clients.conf
new file mode 100644
index 000000000..5fb47a2ad
--- /dev/null
+++ b/testing/hosts/alice/etc/freeradius/clients.conf
@@ -0,0 +1,4 @@
+client 10.1.0.1 {
+ secret = gv6URkSs
+ shortname = moon
+}
diff --git a/testing/hosts/alice/etc/freeradius/dictionary b/testing/hosts/alice/etc/freeradius/dictionary
new file mode 100644
index 000000000..59a874b3e
--- /dev/null
+++ b/testing/hosts/alice/etc/freeradius/dictionary
@@ -0,0 +1,32 @@
+#
+# This is the master dictionary file, which references the
+# pre-defined dictionary files included with the server.
+#
+# Any new/changed attributes MUST be placed in this file, as
+# the pre-defined dictionaries SHOULD NOT be edited.
+#
+# $Id$
+#
+
+#
+# The filename given here should be an absolute path.
+#
+$INCLUDE /usr/local/share/freeradius/dictionary
+
+#
+# Place additional attributes or $INCLUDEs here. They will
+# over-ride the definitions in the pre-defined dictionaries.
+#
+# See the 'man' page for 'dictionary' for information on
+# the format of the dictionary files.
+
+#
+# If you want to add entries to the dictionary file,
+# which are NOT going to be placed in a RADIUS packet,
+# add them here. The numbers you pick should be between
+# 3000 and 4000.
+#
+
+#ATTRIBUTE My-Local-String 3000 string
+#ATTRIBUTE My-Local-IPAddr 3001 ipaddr
+#ATTRIBUTE My-Local-Integer 3002 integer
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/hosts/alice/etc/freeradius/radiusd.conf
index 1143a0473..e4f721738 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/radiusd.conf
+++ b/testing/hosts/alice/etc/freeradius/radiusd.conf
@@ -5,16 +5,16 @@ exec_prefix = ${prefix}
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
+logdir = ${localstatedir}/log/freeradius
+raddbdir = ${sysconfdir}/freeradius
radacctdir = ${logdir}/radacct
# name of the running server. See also the "-n" command-line option.
-name = radiusd
+name = freeradius
# Location of config and logfiles.
confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
+run_dir = ${localstatedir}/run
# Should likely be ${localstatedir}/lib/radiusd
db_dir = ${raddbdir}
@@ -37,7 +37,7 @@ max_requests = 1024
# listen: Make the server listen on a particular IP address, and send
listen {
type = auth
- ipaddr = PH_IP_ALICE
+ ipaddr = 10.1.0.10
port = 0
}
@@ -46,7 +46,7 @@ listen {
#
listen {
type = acct
- ipaddr = PH_IP_ALICE
+ ipaddr = 10.1.0.10
port = 0
}
@@ -66,9 +66,9 @@ log {
file = ${logdir}/radius.log
syslog_facility = daemon
stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
+ auth = yes
+ auth_badpass = yes
+ auth_goodpass = yes
}
# The program to execute to do concurrency checks.
diff --git a/testing/hosts/alice/etc/hostname b/testing/hosts/alice/etc/hostname
new file mode 100644
index 000000000..c9fc40bfb
--- /dev/null
+++ b/testing/hosts/alice/etc/hostname
@@ -0,0 +1 @@
+alice
diff --git a/testing/hosts/alice/etc/init.d/iptables b/testing/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index 1097ac5a4..000000000
--- a/testing/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/hosts/alice/etc/init.d/net.eth0 b/testing/hosts/alice/etc/init.d/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/alice/etc/init.d/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/alice/etc/init.d/net.eth1 b/testing/hosts/alice/etc/init.d/net.eth1
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/alice/etc/init.d/net.eth1
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/alice/etc/init.d/radiusd b/testing/hosts/alice/etc/init.d/radiusd
deleted file mode 100755
index 8334385f9..000000000
--- a/testing/hosts/alice/etc/init.d/radiusd
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/sbin/runscript
-
-opts="${opts} reload"
-
-depend() {
- need net
- use dns
-}
-
-checkconfig() {
- # set the location of log files
- if ! cd /var/log/radius ; then
- eerror "Failed to change current directory to /var/log/radius"
- return 1
- fi
-
- if [ ! -d /var/run/radiusd ] && ! mkdir /var/run/radiusd ; then
- eerror "Failed to create /var/run/radiusd"
- return 1
- fi
-
- if [ ! -f /etc/raddb/radiusd.conf ] ; then
- eerror "No /etc/raddb/radiusd.conf file exists!"
- return 1
- fi
-
- RADIUSD_OPTS="-xx"
- RADIUSD_USER=`grep '^ *user *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3`
- RADIUSD_GROUP=`grep '^ *group *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3`
- if [ -n "${RADIUSD_USER}" ] && ! getent passwd ${RADIUSD_USER} > /dev/null ; then
- eerror "${RADIUSD_USER} user missing!"
- return 1
- fi
- if [ -n "${RADIUSD_GROUP}" ] && ! getent group ${RADIUSD_GROUP} > /dev/null ; then
- eerror "${RADIUSD_GROUP} group missing!"
- return 1
- fi
-
- # radius.log is created before privileges are dropped - need to set proper permissions on it
- [ -f radius.log ] || touch radius.log || return 1
-
- chown -R "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" . /var/run/radiusd && \
- chmod -R u+rwX,g+rX . /var/run/radiusd || return 1
-}
-
-start() {
- checkconfig || return 1
-
- ebegin "Starting radiusd"
- start-stop-daemon --start --quiet --exec /usr/sbin/radiusd -- ${RADIUSD_OPTS} >/dev/null
- eend $?
-}
-
-stop () {
- ebegin "Stopping radiusd"
- start-stop-daemon --stop --quiet --pidfile=/var/run/radiusd/radiusd.pid
- eend $?
-}
-
-reload () {
- ebegin "Reloading radiusd"
- kill -HUP `</var/run/radiusd/radiusd.pid`
- eend $?
-}
diff --git a/testing/hosts/alice/etc/ipsec.conf b/testing/hosts/alice/etc/ipsec.conf
index 0671537e9..6d8aa629d 100755..100644
--- a/testing/hosts/alice/etc/ipsec.conf
+++ b/testing/hosts/alice/etc/ipsec.conf
@@ -13,7 +13,7 @@ conn nat-t
leftcert=aliceCert.pem
leftid=alice@strongswan.org
leftfirewall=yes
- right=PH_IP_SUN
+ right=192.168.0.2
rightid=@sun.strongswan.org
rightsubnet=10.2.0.0/16
auto=add
diff --git a/testing/hosts/alice/etc/network/interfaces b/testing/hosts/alice/etc/network/interfaces
new file mode 100644
index 000000000..6fcbaa597
--- /dev/null
+++ b/testing/hosts/alice/etc/network/interfaces
@@ -0,0 +1,20 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet static
+ address 10.1.0.10
+ netmask 255.255.0.0
+ broadcast 10.1.255.255
+ gateway 10.1.0.1
+iface eth0 inet6 static
+ address fec1::10
+ netmask 16
+
+iface eth1 inet static
+ address 192.168.0.50
+ netmask 255.255.255.0
+ broadcast 192.168.0.255
+iface eth1 inet6 static
+ address fec0::5
+ netmask 16
diff --git a/testing/hosts/alice/etc/runlevels/default/net.eth0 b/testing/hosts/alice/etc/runlevels/default/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/alice/etc/runlevels/default/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/bob/etc/conf.d/hostname b/testing/hosts/bob/etc/conf.d/hostname
deleted file mode 100644
index bbf5a2ea6..000000000
--- a/testing/hosts/bob/etc/conf.d/hostname
+++ /dev/null
@@ -1 +0,0 @@
-HOSTNAME=bob
diff --git a/testing/hosts/bob/etc/conf.d/net b/testing/hosts/bob/etc/conf.d/net
deleted file mode 100644
index bd0b3a5ce..000000000
--- a/testing/hosts/bob/etc/conf.d/net
+++ /dev/null
@@ -1,10 +0,0 @@
-# /etc/conf.d/net:
-
-# This is basically the ifconfig argument without the ifconfig $iface
-#
-config_eth0=( "PH_IP_BOB broadcast 10.2.255.255 netmask 255.255.0.0"
- "PH_IP6_BOB/16" )
-
-# For setting the default gateway
-#
-routes_eth0=( "default via PH_IP_SUN1" )
diff --git a/testing/hosts/bob/etc/hostname b/testing/hosts/bob/etc/hostname
new file mode 100644
index 000000000..696fb6baa
--- /dev/null
+++ b/testing/hosts/bob/etc/hostname
@@ -0,0 +1 @@
+bob
diff --git a/testing/hosts/bob/etc/init.d/iptables b/testing/hosts/bob/etc/init.d/iptables
deleted file mode 100755
index 7b8756b81..000000000
--- a/testing/hosts/bob/etc/init.d/iptables
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/hosts/bob/etc/init.d/net.eth0 b/testing/hosts/bob/etc/init.d/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/bob/etc/init.d/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/bob/etc/ipsec.conf b/testing/hosts/bob/etc/ipsec.conf
index 5896c3436..5896c3436 100755..100644
--- a/testing/hosts/bob/etc/ipsec.conf
+++ b/testing/hosts/bob/etc/ipsec.conf
diff --git a/testing/hosts/bob/etc/network/interfaces b/testing/hosts/bob/etc/network/interfaces
new file mode 100644
index 000000000..eca4f8fe7
--- /dev/null
+++ b/testing/hosts/bob/etc/network/interfaces
@@ -0,0 +1,12 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet static
+ address 10.2.0.10
+ netmask 255.255.0.0
+ broadcast 10.2.255.255
+ gateway 10.2.0.1
+iface eth0 inet6 static
+ address fec2::10
+ netmask 16
diff --git a/testing/hosts/bob/etc/runlevels/default/net.eth0 b/testing/hosts/bob/etc/runlevels/default/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/bob/etc/runlevels/default/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/carol/etc/conf.d/hostname b/testing/hosts/carol/etc/conf.d/hostname
deleted file mode 100644
index d5101b924..000000000
--- a/testing/hosts/carol/etc/conf.d/hostname
+++ /dev/null
@@ -1 +0,0 @@
-HOSTNAME=carol
diff --git a/testing/hosts/carol/etc/conf.d/net b/testing/hosts/carol/etc/conf.d/net
deleted file mode 100644
index f7f685942..000000000
--- a/testing/hosts/carol/etc/conf.d/net
+++ /dev/null
@@ -1,10 +0,0 @@
-# /etc/conf.d/net:
-
-# This is basically the ifconfig argument without the ifconfig $iface
-#
-config_eth0=( "PH_IP_CAROL broadcast 192.168.0.255 netmask 255.255.255.0"
- "PH_IP6_CAROL/16" )
-
-# For setting the default gateway
-#
-routes_eth0=( "default via 192.168.0.254" )
diff --git a/testing/hosts/carol/etc/hostname b/testing/hosts/carol/etc/hostname
new file mode 100644
index 000000000..da4b06358
--- /dev/null
+++ b/testing/hosts/carol/etc/hostname
@@ -0,0 +1 @@
+carol
diff --git a/testing/hosts/carol/etc/init.d/iptables b/testing/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 6ff11a424..000000000
--- a/testing/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/hosts/carol/etc/init.d/net.eth0 b/testing/hosts/carol/etc/init.d/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/carol/etc/init.d/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/carol/etc/ipsec.conf b/testing/hosts/carol/etc/ipsec.conf
index 0848ee716..d2d481b68 100755..100644
--- a/testing/hosts/carol/etc/ipsec.conf
+++ b/testing/hosts/carol/etc/ipsec.conf
@@ -9,11 +9,11 @@ conn %default
keyingtries=1
conn home
- left=PH_IP_CAROL
+ left=192.168.0.100
leftcert=carolCert.pem
leftid=carol@strongswan.org
leftfirewall=yes
- right=PH_IP_MOON
+ right=192.168.0.1
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add
diff --git a/testing/hosts/carol/etc/network/interfaces b/testing/hosts/carol/etc/network/interfaces
new file mode 100644
index 000000000..67bc73359
--- /dev/null
+++ b/testing/hosts/carol/etc/network/interfaces
@@ -0,0 +1,12 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet static
+ address 192.168.0.100
+ netmask 255.255.255.0
+ broadcast 192.168.0.255
+ gateway 192.168.0.254
+iface eth0 inet6 static
+ address fec0::10
+ netmask 16
diff --git a/testing/hosts/carol/etc/runlevels/default/net.eth0 b/testing/hosts/carol/etc/runlevels/default/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/carol/etc/runlevels/default/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/dave/etc/conf.d/hostname b/testing/hosts/dave/etc/conf.d/hostname
deleted file mode 100644
index c3fabf331..000000000
--- a/testing/hosts/dave/etc/conf.d/hostname
+++ /dev/null
@@ -1 +0,0 @@
-HOSTNAME=dave
diff --git a/testing/hosts/dave/etc/conf.d/net b/testing/hosts/dave/etc/conf.d/net
deleted file mode 100644
index 2b902525a..000000000
--- a/testing/hosts/dave/etc/conf.d/net
+++ /dev/null
@@ -1,10 +0,0 @@
-# /etc/conf.d/net:
-
-# This is basically the ifconfig argument without the ifconfig $iface
-#
-config_eth0=( "PH_IP_DAVE broadcast 192.168.0.255 netmask 255.255.255.0"
- "PH_IP6_DAVE/16" )
-
-# For setting the default gateway
-#
-routes_eth0=( "default via 192.168.0.254" )
diff --git a/testing/hosts/dave/etc/hostname b/testing/hosts/dave/etc/hostname
new file mode 100644
index 000000000..9fcf7b10e
--- /dev/null
+++ b/testing/hosts/dave/etc/hostname
@@ -0,0 +1 @@
+dave
diff --git a/testing/hosts/dave/etc/init.d/iptables b/testing/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index 6ff11a424..000000000
--- a/testing/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/hosts/dave/etc/init.d/net.eth0 b/testing/hosts/dave/etc/init.d/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/dave/etc/init.d/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/dave/etc/ipsec.conf b/testing/hosts/dave/etc/ipsec.conf
index 96502581e..5c546e260 100755..100644
--- a/testing/hosts/dave/etc/ipsec.conf
+++ b/testing/hosts/dave/etc/ipsec.conf
@@ -9,11 +9,11 @@ conn %default
keyingtries=1
conn home
- left=PH_IP_DAVE
+ left=192.168.0.200
leftcert=daveCert.pem
leftid=dave@strongswan.org
leftfirewall=yes
- right=PH_IP_MOON
+ right=192.168.0.1
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add
diff --git a/testing/hosts/dave/etc/network/interfaces b/testing/hosts/dave/etc/network/interfaces
new file mode 100644
index 000000000..59e526751
--- /dev/null
+++ b/testing/hosts/dave/etc/network/interfaces
@@ -0,0 +1,12 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet static
+ address 192.168.0.200
+ netmask 255.255.255.0
+ broadcast 192.168.0.255
+ gateway 192.168.0.254
+iface eth0 inet6 static
+ address fec0::20
+ netmask 16
diff --git a/testing/hosts/dave/etc/runlevels/default/net.eth0 b/testing/hosts/dave/etc/runlevels/default/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/dave/etc/runlevels/default/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/default/etc/default/slapd b/testing/hosts/default/etc/default/slapd
new file mode 100644
index 000000000..a4a0a6e2a
--- /dev/null
+++ b/testing/hosts/default/etc/default/slapd
@@ -0,0 +1,45 @@
+# Default location of the slapd.conf file or slapd.d cn=config directory. If
+# empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to
+# /etc/ldap/slapd.conf).
+SLAPD_CONF=/etc/ldap/slapd.conf
+
+# System account to run the slapd server under. If empty the server
+# will run as root.
+SLAPD_USER="openldap"
+
+# System group to run the slapd server under. If empty the server will
+# run in the primary group of its user.
+SLAPD_GROUP="openldap"
+
+# Path to the pid file of the slapd server. If not set the init.d script
+# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf by
+# default)
+SLAPD_PIDFILE=
+
+# slapd normally serves ldap only on all TCP-ports 389. slapd can also
+# service requests on TCP-port 636 (ldaps) and requests via unix
+# sockets.
+# Example usage:
+# SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
+SLAPD_SERVICES="ldap:///"
+
+# If SLAPD_NO_START is set, the init script will not start or restart
+# slapd (but stop will still work). Uncomment this if you are
+# starting slapd via some other means or if you don't want slapd normally
+# started at boot.
+#SLAPD_NO_START=1
+
+# If SLAPD_SENTINEL_FILE is set to path to a file and that file exists,
+# the init script will not start or restart slapd (but stop will still
+# work). Use this for temporarily disabling startup of slapd (when doing
+# maintenance, for example, or through a configuration management system)
+# when you don't want to edit a configuration file.
+SLAPD_SENTINEL_FILE=/etc/ldap/noslapd
+
+# For Kerberos authentication (via SASL), slapd by default uses the system
+# keytab file (/etc/krb5.keytab). To use a different keytab file,
+# uncomment this line and change the path.
+#export KRB5_KTNAME=/etc/krb5.keytab
+
+# Additional options to pass to slapd
+SLAPD_OPTIONS=""
diff --git a/testing/hosts/default/etc/fstab b/testing/hosts/default/etc/fstab
new file mode 100644
index 000000000..12747232e
--- /dev/null
+++ b/testing/hosts/default/etc/fstab
@@ -0,0 +1 @@
+/hostshare /root/shared 9p trans=virtio,version=9p2000.L 0 0
diff --git a/testing/hosts/default/etc/ip6tables.flush b/testing/hosts/default/etc/ip6tables.flush
new file mode 100644
index 000000000..c3f5a9254
--- /dev/null
+++ b/testing/hosts/default/etc/ip6tables.flush
@@ -0,0 +1,15 @@
+*filter
+
+-F
+
+-P INPUT ACCEPT
+-P OUTPUT ACCEPT
+-P FORWARD ACCEPT
+
+COMMIT
+
+*mangle
+
+-F
+
+COMMIT
diff --git a/testing/hosts/default/etc/ip6tables.rules b/testing/hosts/default/etc/ip6tables.rules
new file mode 100644
index 000000000..6a2c6af8e
--- /dev/null
+++ b/testing/hosts/default/etc/ip6tables.rules
@@ -0,0 +1,39 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow last UDP fragment
+-A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# allow crl and certficate fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s fec0::15 -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d fec0::15 -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/hosts/default/etc/iptables.drop b/testing/hosts/default/etc/iptables.drop
new file mode 100644
index 000000000..445c45669
--- /dev/null
+++ b/testing/hosts/default/etc/iptables.drop
@@ -0,0 +1,12 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+COMMIT
diff --git a/testing/hosts/default/etc/iptables.flush b/testing/hosts/default/etc/iptables.flush
new file mode 100644
index 000000000..b3ab63c51
--- /dev/null
+++ b/testing/hosts/default/etc/iptables.flush
@@ -0,0 +1,21 @@
+*filter
+
+-F
+
+-P INPUT ACCEPT
+-P OUTPUT ACCEPT
+-P FORWARD ACCEPT
+
+COMMIT
+
+*nat
+
+-F
+
+COMMIT
+
+*mangle
+
+-F
+
+COMMIT
diff --git a/testing/hosts/default/etc/iptables.rules b/testing/hosts/default/etc/iptables.rules
new file mode 100644
index 000000000..c3f036cf9
--- /dev/null
+++ b/testing/hosts/default/etc/iptables.rules
@@ -0,0 +1,28 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s 192.168.0.150 -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d 192.168.0.150 -j ACCEPT
+
+COMMIT
diff --git a/testing/hosts/default/etc/profile.d/coredumps.sh b/testing/hosts/default/etc/profile.d/coredumps.sh
new file mode 100644
index 000000000..ea44c0ef6
--- /dev/null
+++ b/testing/hosts/default/etc/profile.d/coredumps.sh
@@ -0,0 +1,5 @@
+#!/bin/sh -e
+
+ulimit -c unlimited >/dev/null 2>&1
+install -m 1777 -d /var/local/dumps >/dev/null 2>&1
+echo "/var/local/dumps/core.%e.%p" > /proc/sys/kernel/core_pattern
diff --git a/testing/hosts/default/etc/rsyslog.conf b/testing/hosts/default/etc/rsyslog.conf
new file mode 100644
index 000000000..9f76da36e
--- /dev/null
+++ b/testing/hosts/default/etc/rsyslog.conf
@@ -0,0 +1,125 @@
+# /etc/rsyslog.conf Configuration file for rsyslog.
+#
+# For more information see
+# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
+
+
+#################
+#### MODULES ####
+#################
+
+$ModLoad imuxsock # provides support for local system logging
+$ModLoad imklog # provides kernel logging support
+#$ModLoad immark # provides --MARK-- message capability
+
+# Don't drop messages
+$SystemLogRateLimitInterval 0
+$RepeatedMsgReduction off
+
+# provides UDP syslog reception
+#$ModLoad imudp
+#$UDPServerRun 514
+
+# provides TCP syslog reception
+#$ModLoad imtcp
+#$InputTCPServerRun 514
+
+
+###########################
+#### GLOBAL DIRECTIVES ####
+###########################
+
+#
+# Use traditional timestamp format.
+# To enable high precision timestamps, comment out the following line.
+#
+$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
+
+#
+# Set the default permissions for all log files.
+#
+$FileOwner root
+$FileGroup adm
+$FileCreateMode 0640
+$DirCreateMode 0755
+$Umask 0022
+
+#
+# Where to place spool and state files
+#
+$WorkDirectory /var/spool/rsyslog
+
+#
+# Include all config files in /etc/rsyslog.d/
+#
+$IncludeConfig /etc/rsyslog.d/*.conf
+
+
+###############
+#### RULES ####
+###############
+
+#
+# First some standard log files. Log by facility.
+#
+auth,authpriv.* /var/log/auth.log
+*.*;auth,authpriv.none -/var/log/syslog
+#cron.* /var/log/cron.log
+daemon.* /var/log/daemon.log
+kern.* -/var/log/kern.log
+lpr.* -/var/log/lpr.log
+mail.* -/var/log/mail.log
+user.* -/var/log/user.log
+
+#
+# Logging for the mail system. Split it up so that
+# it is easy to write scripts to parse these files.
+#
+mail.info -/var/log/mail.info
+mail.warn -/var/log/mail.warn
+mail.err /var/log/mail.err
+
+#
+# Logging for INN news system.
+#
+news.crit /var/log/news/news.crit
+news.err /var/log/news/news.err
+news.notice -/var/log/news/news.notice
+
+#
+# Some "catch-all" log files.
+#
+*.=debug;\
+ auth,authpriv.none;\
+ news.none;mail.none -/var/log/debug
+*.=info;*.=notice;*.=warn;\
+ auth,authpriv.none;\
+ cron,daemon.none;\
+ mail,news.none -/var/log/messages
+
+#
+# Emergencies are sent to everybody logged in.
+#
+*.emerg :omusrmsg:*
+
+#
+# I like to have messages displayed on the console, but only on a virtual
+# console I usually leave idle.
+#
+#daemon,mail.*;\
+# news.=crit;news.=err;news.=notice;\
+# *.=debug;*.=info;\
+# *.=notice;*.=warn /dev/tty8
+
+# The named pipe /dev/xconsole is for the `xconsole' utility. To use it,
+# you must invoke `xconsole' with the `-file' option:
+#
+# $ xconsole -file /dev/xconsole [...]
+#
+# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
+# busy site..
+#
+daemon.*;mail.*;\
+ news.err;\
+ *.=debug;*.=info;\
+ *.=notice;*.=warn |/dev/xconsole
diff --git a/testing/hosts/default/etc/security/limits.conf b/testing/hosts/default/etc/security/limits.conf
new file mode 100644
index 000000000..2658b3236
--- /dev/null
+++ b/testing/hosts/default/etc/security/limits.conf
@@ -0,0 +1,58 @@
+# /etc/security/limits.conf
+#
+#Each line describes a limit for a user in the form:
+#
+#<domain> <type> <item> <value>
+#
+#Where:
+#<domain> can be:
+# - an user name
+# - a group name, with @group syntax
+# - the wildcard *, for default entry
+# - the wildcard %, can be also used with %group syntax,
+# for maxlogin limit
+# - NOTE: group and wildcard limits are not applied to root.
+# To apply a limit to the root user, <domain> must be
+# the literal username root.
+#
+#<type> can have the two values:
+# - "soft" for enforcing the soft limits
+# - "hard" for enforcing hard limits
+#
+#<item> can be one of the following:
+# - core - limits the core file size (KB)
+# - data - max data size (KB)
+# - fsize - maximum filesize (KB)
+# - memlock - max locked-in-memory address space (KB)
+# - nofile - max number of open files
+# - rss - max resident set size (KB)
+# - stack - max stack size (KB)
+# - cpu - max CPU time (MIN)
+# - nproc - max number of processes
+# - as - address space limit (KB)
+# - maxlogins - max number of logins for this user
+# - maxsyslogins - max number of logins on the system
+# - priority - the priority to run user process with
+# - locks - max number of file locks the user can hold
+# - sigpending - max number of pending signals
+# - msgqueue - max memory used by POSIX message queues (bytes)
+# - nice - max nice priority allowed to raise to values: [-20, 19]
+# - rtprio - max realtime priority
+# - chroot - change root to directory (Debian-specific)
+#
+#<domain> <type> <item> <value>
+#
+
+#* soft core 0
+#root hard core 100000
+#* hard rss 10000
+#@student hard nproc 20
+#@faculty soft nproc 20
+#@faculty hard nproc 50
+#ftp hard nproc 0
+#ftp - chroot /ftp
+#@student - maxlogins 4
+
+* soft core unlimited
+
+# End of file
diff --git a/testing/hosts/default/etc/ssh/sshd_config b/testing/hosts/default/etc/ssh/sshd_config
new file mode 100644
index 000000000..07b7e78e5
--- /dev/null
+++ b/testing/hosts/default/etc/ssh/sshd_config
@@ -0,0 +1,13 @@
+Port 22
+Protocol 2
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+UsePrivilegeSeparation no
+PermitRootLogin yes
+StrictModes no
+PubkeyAuthentication no
+PermitEmptyPasswords yes
+PrintMotd no
+PrintLastLog no
+UsePAM no
diff --git a/testing/hosts/default/etc/sysctl.conf b/testing/hosts/default/etc/sysctl.conf
new file mode 100644
index 000000000..43010d52e
--- /dev/null
+++ b/testing/hosts/default/etc/sysctl.conf
@@ -0,0 +1,62 @@
+#
+# /etc/sysctl.conf - Configuration file for setting system variables
+# See /etc/sysctl.d/ for additonal system variables
+# See sysctl.conf (5) for information.
+#
+
+#kernel.domainname = example.com
+
+# Uncomment the following to stop low-level messages on console
+#kernel.printk = 3 4 1 3
+
+##############################################################3
+# Functions previously found in netbase
+#
+
+# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
+# Turn on Source Address Verification in all interfaces to
+# prevent some spoofing attacks
+#net.ipv4.conf.default.rp_filter=1
+#net.ipv4.conf.all.rp_filter=1
+
+# Uncomment the next line to enable TCP/IP SYN cookies
+# See http://lwn.net/Articles/277146/
+# Note: This may impact IPv6 TCP sessions too
+#net.ipv4.tcp_syncookies=1
+
+# Uncomment the next line to enable packet forwarding for IPv4
+net.ipv4.ip_forward=1
+
+# Uncomment the next line to enable packet forwarding for IPv6
+# Enabling this option disables Stateless Address Autoconfiguration
+# based on Router Advertisements for this host
+net.ipv6.conf.all.forwarding=1
+
+
+###################################################################
+# Additional settings - these settings can improve the network
+# security of the host and prevent against some network attacks
+# including spoofing attacks and man in the middle attacks through
+# redirection. Some network environments, however, require that these
+# settings are disabled so review and enable them as needed.
+#
+# Do not accept ICMP redirects (prevent MITM attacks)
+#net.ipv4.conf.all.accept_redirects = 0
+#net.ipv6.conf.all.accept_redirects = 0
+# _or_
+# Accept ICMP redirects only for gateways listed in our default
+# gateway list (enabled by default)
+# net.ipv4.conf.all.secure_redirects = 1
+#
+# Do not send ICMP redirects (we are not a router)
+#net.ipv4.conf.all.send_redirects = 0
+#
+# Do not accept IP source route packets (we are not a router)
+#net.ipv4.conf.all.accept_source_route = 0
+#net.ipv6.conf.all.accept_source_route = 0
+#
+# Log Martian Packets
+#net.ipv4.conf.all.log_martians = 1
+
+# Enable coredump for suid binaries
+fs.suid_dumpable = 1
diff --git a/testing/hosts/default/root/.ssh/config b/testing/hosts/default/root/.ssh/config
new file mode 100644
index 000000000..aa102a144
--- /dev/null
+++ b/testing/hosts/default/root/.ssh/config
@@ -0,0 +1,3 @@
+Host *
+ StrictHostKeyChecking no
+ UserKnownHostsFile /dev/null
diff --git a/testing/hosts/default/usr/local/bin/expect-connection b/testing/hosts/default/usr/local/bin/expect-connection
new file mode 100755
index 000000000..10a709255
--- /dev/null
+++ b/testing/hosts/default/usr/local/bin/expect-connection
@@ -0,0 +1,27 @@
+#!/bin/bash
+#
+# Wait until a given IPsec connection becomes available
+#
+# Params:
+# $1 - connection name
+# $2 - maximum time to wait in seconds, default is 5 seconds
+
+if [[ $# -lt 1 || $# -gt 2 ]]
+then
+ echo "invalid arguments"
+ exit 1
+fi
+
+secs=$2
+[ ! $secs ] && secs=5
+
+let steps=$secs*10
+for i in `seq 1 $steps`
+do
+ ipsec statusall 2>&1 | grep ^[[:space:]]*$1: >/dev/null
+ [ $? -eq 0 ] && exit 0
+ sleep 0.1
+done
+
+echo "Connection '$1' not available after $secs second(s)"
+exit 1
diff --git a/testing/hosts/moon/etc/conf.d/hostname b/testing/hosts/moon/etc/conf.d/hostname
deleted file mode 100644
index 78e695337..000000000
--- a/testing/hosts/moon/etc/conf.d/hostname
+++ /dev/null
@@ -1 +0,0 @@
-HOSTNAME=moon
diff --git a/testing/hosts/moon/etc/conf.d/net b/testing/hosts/moon/etc/conf.d/net
deleted file mode 100644
index 7f09fd8a5..000000000
--- a/testing/hosts/moon/etc/conf.d/net
+++ /dev/null
@@ -1,12 +0,0 @@
-# /etc/conf.d/net:
-
-# This is basically the ifconfig argument without the ifconfig $iface
-#
-config_eth0=( "PH_IP_MOON broadcast 192.168.0.255 netmask 255.255.255.0"
- "PH_IP6_MOON/16" )
-config_eth1=( "PH_IP_MOON1 broadcast 10.1.255.255 netmask 255.255.0.0"
- "PH_IP6_MOON1/16" )
-
-# For setting the default gateway
-#
-routes_eth0=( "default via 192.168.0.254" )
diff --git a/testing/hosts/moon/etc/hostname b/testing/hosts/moon/etc/hostname
new file mode 100644
index 000000000..605185ef1
--- /dev/null
+++ b/testing/hosts/moon/etc/hostname
@@ -0,0 +1 @@
+moon
diff --git a/testing/hosts/moon/etc/init.d/iptables b/testing/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index f5fa80b26..000000000
--- a/testing/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/hosts/moon/etc/init.d/net.eth0 b/testing/hosts/moon/etc/init.d/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/moon/etc/init.d/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/moon/etc/init.d/net.eth1 b/testing/hosts/moon/etc/init.d/net.eth1
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/moon/etc/init.d/net.eth1
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/moon/etc/ipsec.conf b/testing/hosts/moon/etc/ipsec.conf
index 6ee481e49..623e75d0a 100755..100644
--- a/testing/hosts/moon/etc/ipsec.conf
+++ b/testing/hosts/moon/etc/ipsec.conf
@@ -7,20 +7,20 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
- left=PH_IP_MOON
+ left=192.168.0.1
leftcert=moonCert.pem
leftid=@moon.strongswan.org
leftfirewall=yes
conn net-net
leftsubnet=10.1.0.0/16
- right=PH_IP_SUN
+ right=192.168.0.2
rightsubnet=10.2.0.0/16
rightid=@sun.strongswan.org
auto=add
-
+
conn host-host
- right=PH_IP_SUN
+ right=192.168.0.2
rightid=@sun.strongswan.org
auto=add
diff --git a/testing/hosts/moon/etc/network/interfaces b/testing/hosts/moon/etc/network/interfaces
new file mode 100644
index 000000000..fde2f102f
--- /dev/null
+++ b/testing/hosts/moon/etc/network/interfaces
@@ -0,0 +1,21 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet static
+ address 192.168.0.1
+ netmask 255.255.255.0
+ broadcast 192.168.0.255
+ gateway 192.168.0.254
+iface eth0 inet6 static
+ address fec0::1
+ netmask 16
+
+auto eth1
+iface eth1 inet static
+ address 10.1.0.1
+ netmask 255.255.0.0
+ broadcast 10.1.255.255
+iface eth1 inet6 static
+ address fec1::1
+ netmask 16
diff --git a/testing/hosts/moon/etc/rc.local b/testing/hosts/moon/etc/rc.local
new file mode 100755
index 000000000..8649a2bcb
--- /dev/null
+++ b/testing/hosts/moon/etc/rc.local
@@ -0,0 +1,20 @@
+#!/bin/sh -e
+#
+# rc.local
+#
+# This script is executed at the end of each multiuser runlevel.
+# Make sure that the script will "exit 0" on success or any other
+# value on error.
+#
+# In order to enable or disable this script just change the execution
+# bits.
+#
+
+# Disable checksum offloading on eth1 because it does not currently work with
+# libvirt and isc-dhcp-server running on venus, see [1]
+# [1] - https://bugs.mageia.org/show_bug.cgi?id=1243
+
+ethtool --offload eth1 tx off >/dev/null 2>&1
+ethtool --offload eth1 rx off >/dev/null 2>&1
+
+exit 0
diff --git a/testing/hosts/moon/etc/runlevels/default/net.eth0 b/testing/hosts/moon/etc/runlevels/default/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/moon/etc/runlevels/default/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/moon/etc/runlevels/default/net.eth1 b/testing/hosts/moon/etc/runlevels/default/net.eth1
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/moon/etc/runlevels/default/net.eth1
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/ssh_host_rsa_key.pub b/testing/hosts/ssh_host_rsa_key.pub
deleted file mode 100644
index a5f71de4e..000000000
--- a/testing/hosts/ssh_host_rsa_key.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsxKfTm05po6leGD8C+M0eAR5EE4s1pQXc0D/dVlqrmfZ65h5BFQY9lnwpCvapV6OVqKWx8ICmeIH3OhaPxPPNKlU81f3d0xgh8BRJpWh459DYkRVa5f7ax5eeFE1lelj9s1d0seUl/IZolpJ8Wmt9TN1hwJ0mrkwN4670rb3urc=
diff --git a/testing/hosts/sun/etc/conf.d/hostname b/testing/hosts/sun/etc/conf.d/hostname
deleted file mode 100644
index bc042b68b..000000000
--- a/testing/hosts/sun/etc/conf.d/hostname
+++ /dev/null
@@ -1 +0,0 @@
-HOSTNAME=sun
diff --git a/testing/hosts/sun/etc/conf.d/net b/testing/hosts/sun/etc/conf.d/net
deleted file mode 100644
index 4a6370ab7..000000000
--- a/testing/hosts/sun/etc/conf.d/net
+++ /dev/null
@@ -1,14 +0,0 @@
-# /etc/conf.d/net:
-
-# This is basically the ifconfig argument without the ifconfig $iface
-#
-config_eth0=( "PH_IP_SUN broadcast 192.168.0.255 netmask 255.255.255.0"
- "PH_IP6_SUN/16" )
-config_eth1=( "PH_IP_SUN1 broadcast 10.2.255.255 netmask 255.255.0.0"
- "PH_IP6_SUN1/16" )
-
-# For setting the default gateway
-#
-routes_eth0=( "default via 192.168.0.254" )
-
-
diff --git a/testing/hosts/sun/etc/hostname b/testing/hosts/sun/etc/hostname
new file mode 100644
index 000000000..692699759
--- /dev/null
+++ b/testing/hosts/sun/etc/hostname
@@ -0,0 +1 @@
+sun
diff --git a/testing/hosts/sun/etc/init.d/iptables b/testing/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index aeaf472fb..000000000
--- a/testing/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/hosts/sun/etc/init.d/net.eth0 b/testing/hosts/sun/etc/init.d/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/sun/etc/init.d/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/sun/etc/init.d/net.eth1 b/testing/hosts/sun/etc/init.d/net.eth1
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/sun/etc/init.d/net.eth1
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/sun/etc/ipsec.conf b/testing/hosts/sun/etc/ipsec.conf
index 277928ec1..2f979f122 100755..100644
--- a/testing/hosts/sun/etc/ipsec.conf
+++ b/testing/hosts/sun/etc/ipsec.conf
@@ -7,20 +7,20 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
- left=PH_IP_SUN
+ left=192.168.0.2
leftcert=sunCert.pem
leftid=@sun.strongswan.org
leftfirewall=yes
conn net-net
leftsubnet=10.2.0.0/16
- right=PH_IP_MOON
+ right=192.168.0.1
rightsubnet=10.1.0.0/16
rightid=@moon.strongswan.org
auto=add
conn host-host
- right=PH_IP_MOON
+ right=192.168.0.1
rightid=@moon.strongswan.org
auto=add
diff --git a/testing/hosts/sun/etc/network/interfaces b/testing/hosts/sun/etc/network/interfaces
new file mode 100644
index 000000000..841735af1
--- /dev/null
+++ b/testing/hosts/sun/etc/network/interfaces
@@ -0,0 +1,21 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet static
+ address 192.168.0.2
+ netmask 255.255.255.0
+ broadcast 192.168.0.255
+ gateway 192.168.0.254
+iface eth0 inet6 static
+ address fec0::2
+ netmask 16
+
+auto eth1
+iface eth1 inet static
+ address 10.2.0.1
+ netmask 255.255.0.0
+ broadcast 10.2.255.255
+iface eth1 inet6 static
+ address fec2::1
+ netmask 16
diff --git a/testing/hosts/sun/etc/runlevels/default/net.eth0 b/testing/hosts/sun/etc/runlevels/default/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/sun/etc/runlevels/default/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/sun/etc/runlevels/default/net.eth1 b/testing/hosts/sun/etc/runlevels/default/net.eth1
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/sun/etc/runlevels/default/net.eth1
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/venus/etc/conf.d/hostname b/testing/hosts/venus/etc/conf.d/hostname
deleted file mode 100644
index c9e3dd1d4..000000000
--- a/testing/hosts/venus/etc/conf.d/hostname
+++ /dev/null
@@ -1 +0,0 @@
-HOSTNAME=venus
diff --git a/testing/hosts/venus/etc/conf.d/net b/testing/hosts/venus/etc/conf.d/net
deleted file mode 100644
index 43ec97807..000000000
--- a/testing/hosts/venus/etc/conf.d/net
+++ /dev/null
@@ -1,10 +0,0 @@
-# /etc/conf.d/net:
-
-# This is basically the ifconfig argument without the ifconfig $iface
-#
-config_eth0=( "PH_IP_VENUS broadcast 10.1.255.255 netmask 255.255.0.0"
- "PH_IP6_VENUS/16" )
-
-# For setting the default gateway
-#
-routes_eth0=( "default via PH_IP_MOON1" )
diff --git a/testing/hosts/venus/etc/hostname b/testing/hosts/venus/etc/hostname
new file mode 100644
index 000000000..acf16d8be
--- /dev/null
+++ b/testing/hosts/venus/etc/hostname
@@ -0,0 +1 @@
+venus
diff --git a/testing/hosts/venus/etc/init.d/iptables b/testing/hosts/venus/etc/init.d/iptables
deleted file mode 100755
index 1097ac5a4..000000000
--- a/testing/hosts/venus/etc/init.d/iptables
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/hosts/venus/etc/init.d/net.eth0 b/testing/hosts/venus/etc/init.d/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/venus/etc/init.d/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/venus/etc/ipsec.conf b/testing/hosts/venus/etc/ipsec.conf
index dd6a82f89..e4604cb44 100755..100644
--- a/testing/hosts/venus/etc/ipsec.conf
+++ b/testing/hosts/venus/etc/ipsec.conf
@@ -13,7 +13,7 @@ conn nat-t
leftcert=venusCert.pem
leftid=@venus.strongswan.org
leftfirewall=yes
- right=PH_IP_SUN
+ right=192.168.0.2
rightid=@sun.strongswan.org
rightsubnet=10.2.0.0/16
auto=add
diff --git a/testing/hosts/venus/etc/network/interfaces b/testing/hosts/venus/etc/network/interfaces
new file mode 100644
index 000000000..9cbae6041
--- /dev/null
+++ b/testing/hosts/venus/etc/network/interfaces
@@ -0,0 +1,12 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet static
+ address 10.1.0.20
+ netmask 255.255.0.0
+ broadcast 10.1.255.255
+ gateway 10.1.0.1
+iface eth0 inet6 static
+ address fec1::20
+ netmask 16
diff --git a/testing/hosts/venus/etc/runlevels/default/net.eth0 b/testing/hosts/venus/etc/runlevels/default/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/venus/etc/runlevels/default/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text b/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text
new file mode 100644
index 000000000..6f5f3011c
--- /dev/null
+++ b/testing/hosts/winnetou/etc/apache2/conf.d/testresults-as-text
@@ -0,0 +1 @@
+AddType text/plain .iptables .log .sql
diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt b/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt
deleted file mode 100644
index 0de3b268d..000000000
--- a/testing/hosts/winnetou/etc/apache2/conf/ssl/ca.crt
+++ /dev/null
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
-MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
-b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
-BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
-Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
-X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
-FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
-4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
-7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
-gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
-K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
-DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
-ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
-VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
-Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
-lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
-+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
-UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
-0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
-gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
------END CERTIFICATE-----
diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt b/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt
deleted file mode 100644
index 956c217d9..000000000
--- a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.crt
+++ /dev/null
@@ -1,24 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIEFTCCAv2gAwIBAgIBDjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
-MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
-b290IENBMB4XDTA1MDYwODE5MTcxNFoXDTEwMDYwNzE5MTcxNFowSjELMAkGA1UE
-BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xIDAeBgNVBAMTF3dpbm5l
-dG91LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqXuh16Ahe3S5vZ
-F56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/u7BlyqpBUtLa
-r14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRBK2gQGBUULo26
-sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqVjlKyqG7vdggk
-wW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3MuOP3FNHIRMd2H
-AcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABo4IBCTCCAQUwCQYDVR0TBAIwADALBgNV
-HQ8EBAMCA6gwHQYDVR0OBBYEFEMS0mbhrA4zDvmfKf4MntUNxkH4MG0GA1UdIwRm
-MGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcG
-A1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290
-IENBggEAMCIGA1UdEQQbMBmCF3dpbm5ldG91LnN0cm9uZ3N3YW4ub3JnMDkGA1Ud
-HwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dh
-bi5jcmwwDQYJKoZIhvcNAQEEBQADggEBACO4+j1Mwt/lbkopeSJst46uFh7OtegG
-6IWNE30i3l3FIn9slSwAOMtmZR0hAF8sExvk61EPlzCR/d9trSJ5+gyjPkeF/enw
-p61rxPMT13Grzomi9gYlk6Q/0zLmE9uYWEY69Q0bEIUcfdZfwB+F7kesa946JNMc
-yHfVEhKtvzmns9ueG0S/8E+6MPDeJv+JHQ++SdWSvOVg6JNxXDGusnim2fjM2Aln
-JmqA6iU4IaPl9DUCuXlLOVv/YhwhviNEbF94upyHq8xjOZdzPbKroHXg/2yvalAw
-4aXc/ZsnFxqsq3i6a2Fj1Y4J7gYsNO/HwA0xvKz3loOTqHaJqO/qeow=
------END CERTIFICATE-----
diff --git a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key b/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key
deleted file mode 100644
index 727027188..000000000
--- a/testing/hosts/winnetou/etc/apache2/conf/ssl/server.key
+++ /dev/null
@@ -1,27 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqX
-uh16Ahe3S5vZF56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/
-u7BlyqpBUtLar14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRB
-K2gQGBUULo26sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqV
-jlKyqG7vdggkwW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3Mu
-OP3FNHIRMd2HAcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABAoIBACYiWrCgl8B/c4Lz
-Uay4Tlm8hvQ/zQJjY3v93EXwbB21hBV8qrYlt9zGfHqj+5q2vsbB9c0pzdO2VDba
-EWueS2fUIWhglEG5VCebrztNCldx2O7jo9bMk8iBt+oLNaJunSK7ACeYHHGcE7dF
-KZh1eyd7z4+SMBWZqmhO5ZisasQoHCusVGepcyyMGQNkc3XKJ6resGAsOqrOoq7Q
-C4vO5Kkbnk8nnEGmQ/ldD8LwIyq1hzVLDiiqWXZgh6S5l4BEo7Dy3KYrZoZfVcZK
-GMVhAI2+uA1ZqY9twpwryT6VZ3eK4DXF/COQntiBW5pLOpaqTOnKqiVmZFwfbo3u
-cq8n5jkCgYEA5zgzRLifbM0q34c2HX8pTegh+BH7MGCxtcoU2uRPaXiGkqQObHI9
-aItrgUQp+pAmKSBnEWJKgKsOh2Uf5ogjIeNuruGG/AXw/Pw2ORHNueenhDuhu69T
-E2I4yxT3PPYbdzJ4ylBElfgm9WTrv7Wi7wSSfgQ6rEFdWukXa5vvsqMCgYEA1K+q
-m1Jv9MGVIVc6MxhuOOj2Ym+qcWt/Pjvg78rR8SRsKwHlGTuv1rdWUSXYDr3f2Nf7
-6DdbJtaSx5f8gY/UG34yGZx5FFbYV03vcCYBaLXsi/b6H7vb/VW74Y5g6bXqnprv
-4mcdVU7xfyNFgdbLPAP9sYVLijPYDwm0Qq3cz/8CgYBKSJz4BBR8AQI4JBl3qoXb
-mKtpJmW76iTN0amXlWgJ64XYkMptftpJvxj/w6V08WDBL77NL/XdlpcpWozAJJac
-6ZOCrcQPLd15eZH2Dck5Y7pG2l2gjbgz7wdt/0NbG3pBdj6mSNlwEPR7PDwdMD6z
-aZWi1LsA4lMaxO4YTVXZ3wKBgQCoFhTNH/+e/YawjNFQJFSn4WUnMn0Pmhc7xfLl
-T/NPkqtx6dN3d7ZmCQrMow33yJOqOje5tFXzgc0KtNE4S8Uj3T4XA5SlQGVFyjAa
-/85JRM2naA8RGVSpCCKuBeoNilnb8zL2SOvjyboN8oAyNuDzk2vh6ihjFsoASHkP
-4XwLXQKBgQC0k6rzt/plIwEiP56XXOqwOxJj6kuE/hx1zGIiGT6lWiOsih20Ym2T
-kYegVFvuDIWmSIAxGONWyee1lfnJbEuaHRixWQTnHUpqrU0FSnZTubnR3q/faZat
-hrvLDdpa0ydAKoMEn3qUPSrh3CdBfi3KTQAQn2Mlk7bGHh9ICWi3vA==
------END RSA PRIVATE KEY-----
diff --git a/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf b/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf
deleted file mode 100644
index 72b7e0ea4..000000000
--- a/testing/hosts/winnetou/etc/apache2/modules.d/00_mod_mime.conf
+++ /dev/null
@@ -1,61 +0,0 @@
-# DefaultType: the default MIME type the server will use for a document
-# if it cannot otherwise determine one, such as from filename extensions.
-# If your server contains mostly text or HTML documents, "text/plain" is
-# a good value. If most of your content is binary, such as applications
-# or images, you may want to use "application/octet-stream" instead to
-# keep browsers from trying to display binary files as though they are
-# text.
-DefaultType text/plain
-
-<IfModule mime_module>
-# TypesConfig points to the file containing the list of mappings from
-# filename extension to MIME-type.
-TypesConfig /etc/mime.types
-
-# AddType allows you to add to or override the MIME configuration
-# file specified in TypesConfig for specific file types.
-#AddType application/x-gzip .tgz
-
-# AddEncoding allows you to have certain browsers uncompress
-# information on the fly. Note: Not all browsers support this.
-#AddEncoding x-compress .Z
-#AddEncoding x-gzip .gz .tgz
-
-# If the AddEncoding directives above are commented-out, then you
-# probably should define those extensions to indicate media types:
-AddType application/x-compress .Z
-AddType application/x-gzip .gz .tgz
-
-# AddHandler allows you to map certain file extensions to "handlers":
-# actions unrelated to filetype. These can be either built into the server
-# or added with the Action directive (see below)
-
-# To use CGI scripts outside of ScriptAliased directories:
-# (You will also need to add "ExecCGI" to the "Options" directive.)
-AddHandler cgi-script .cgi
-
-# For files that include their own HTTP headers:
-#AddHandler send-as-is asis
-
-# For server-parsed imagemap files:
-#AddHandler imap-file map
-
-# For type maps (negotiated resources):
-AddHandler type-map var
-
-# Filters allow you to process content before it is sent to the client.
-#
-# To parse .shtml files for server-side includes (SSI):
-# (You will also need to add "Includes" to the "Options" directive.)
-#AddType text/html .shtml
-#AddOutputFilter INCLUDES .shtml
-</IfModule>
-
-<IfModule mime_magic_module>
-# The mod_mime_magic module allows the server to use various hints from the
-# contents of the file itself to determine its type. The MIMEMagicFile
-# directive tells the module where the hint definitions are located.
-MIMEMagicFile /etc/apache2/magic
-</IfModule>
-
-# vim: ts=4 filetype=apache
diff --git a/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf b/testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost
index 9a32412db..b76080e37 100644
--- a/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf
+++ b/testing/hosts/winnetou/etc/apache2/sites-enabled/001-ocsp_vhost
@@ -2,6 +2,8 @@
Listen 8880
+AddHandler cgi-script .cgi
+
<VirtualHost *:8880>
ServerAdmin root@strongswan.org
DocumentRoot /etc/openssl/ocsp
diff --git a/testing/hosts/winnetou/etc/conf.d/hostname b/testing/hosts/winnetou/etc/conf.d/hostname
deleted file mode 100644
index 1bfa5acbd..000000000
--- a/testing/hosts/winnetou/etc/conf.d/hostname
+++ /dev/null
@@ -1 +0,0 @@
-HOSTNAME=winnetou
diff --git a/testing/hosts/winnetou/etc/conf.d/net b/testing/hosts/winnetou/etc/conf.d/net
deleted file mode 100644
index 7fbc37014..000000000
--- a/testing/hosts/winnetou/etc/conf.d/net
+++ /dev/null
@@ -1,10 +0,0 @@
-# /etc/conf.d/net:
-
-# This is basically the ifconfig argument without the ifconfig $iface
-#
-config_eth0=( "PH_IP_WINNETOU broadcast 192.168.0.255 netmask 255.255.255.0"
- "PH_IP6_WINNETOU/16" )
-
-# For setting the default gateway
-#
-routes_eth0=( "default via 192.168.0.254" )
diff --git a/testing/hosts/winnetou/etc/conf.d/slapd b/testing/hosts/winnetou/etc/conf.d/slapd
deleted file mode 100644
index 8d9ac4787..000000000
--- a/testing/hosts/winnetou/etc/conf.d/slapd
+++ /dev/null
@@ -1,8 +0,0 @@
-# conf.d file for the openldap-2.1 series
-#
-# To enable both the standard unciphered server and the ssl encrypted
-# one uncomment this line or set any other server starting options
-# you may desire.
-#
-# OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"
-OPTS="-4"
diff --git a/testing/hosts/winnetou/etc/init.d/apache2 b/testing/hosts/winnetou/etc/init.d/apache2
deleted file mode 100755
index 5f72d3090..000000000
--- a/testing/hosts/winnetou/etc/init.d/apache2
+++ /dev/null
@@ -1,121 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2007 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="configtest fullstatus graceful gracefulstop modules reload"
-
-depend() {
- need net
- use mysql dns logger netmount postgresql
- after sshd
-}
-
-configtest() {
- ebegin "Checking Apache Configuration"
- checkconfig
- eend $?
-}
-
-checkconfig() {
- SERVERROOT="${SERVERROOT:-/usr/lib/apache2}"
- if [ ! -d ${SERVERROOT} ]; then
- eerror "SERVERROOT does not exist: ${SERVERROOT}"
- return 1
- fi
-
- CONFIGFILE="${CONFIGFILE:-/etc/apache2/httpd.conf}"
- [ "${CONFIGFILE#/}" = "${CONFIGFILE}" ] && CONFIGFILE="${SERVERROOT}/${CONFIGFILE}"
- if [ ! -r "${CONFIGFILE}" ]; then
- eerror "Unable to read configuration file: ${CONFIGFILE}"
- return 1
- fi
-
- APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}"
- APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}"
- [ -n "${STARTUPERRORLOG}" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}"
-
- APACHE2="/usr/sbin/apache2"
-
- ${APACHE2} ${APACHE2_OPTS} -t 1>/dev/null 2>&1
- ret=$?
- if [ $ret -ne 0 ]; then
- eerror "Apache2 has detected a syntax error in your configuration files:"
- ${APACHE2} ${APACHE2_OPTS} -t
- fi
-
- return $ret
-}
-
-start() {
- checkconfig || return 1
- ebegin "Starting apache2"
- [ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache
-
- start-stop-daemon --start --exec ${APACHE2} -- ${APACHE2_OPTS} -k start
- eend $?
-}
-
-stop() {
- checkconfig || return 1
- ebegin "Stopping apache2"
- start-stop-daemon --stop --retry -TERM/5/-KILL/5 --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
-}
-
-reload() {
- RELOAD_TYPE="${RELOAD_TYPE:-graceful}"
-
- checkconfig || return 1
- if [ "${RELOAD_TYPE}" = "restart" ]; then
- ebegin "Restarting apache2"
- start-stop-daemon --stop --oknodo --signal HUP --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
- elif [ "${RELOAD_TYPE}" = "graceful" ]; then
- ebegin "Gracefully restarting apache2"
- start-stop-daemon --stop --oknodo --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
- else
- eerror "${RELOAD_TYPE} is not a valid RELOAD_TYPE. Please edit /etc/conf.d/apache2"
- fi
-}
-
-graceful() {
- checkconfig || return 1
- ebegin "Gracefully restarting apache2"
- start-stop-daemon --stop --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
-}
-
-gracefulstop() {
- checkconfig || return 1
-
- # zap!
- if service_started "${myservice}"; then
- mark_service_stopped "${myservice}"
- fi
-
- ebegin "Gracefully stopping apache2"
- # 28 is SIGWINCH
- start-stop-daemon --stop --signal 28 --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
-}
-
-modules() {
- checkconfig || return 1
-
- ${APACHE2} ${APACHE2_OPTS} -M 2>&1
-}
-
-status() {
- LYNX="${LYNX:-lynx -dump}"
- STATUSURL="${STATUSURL:-http://localhost/server-status}"
-
- ${LYNX} ${STATUSURL} | awk ' /process$/ { print; exit } { print } '
-}
-
-fullstatus() {
- LYNX="${LYNX:-lynx -dump}"
- STATUSURL="${STATUSURL:-http://localhost/server-status}"
-
- ${LYNX} ${STATUSURL}
-}
diff --git a/testing/hosts/winnetou/etc/init.d/net.eth0 b/testing/hosts/winnetou/etc/init.d/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/winnetou/etc/init.d/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/hosts/winnetou/etc/init.d/slapd b/testing/hosts/winnetou/etc/init.d/slapd
deleted file mode 100755
index d4c070b33..000000000
--- a/testing/hosts/winnetou/etc/init.d/slapd
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/strongswan/testing/hosts/winnetou/etc/init.d/slapd,v 1.2 2005/05/31 14:04:43 as Exp $
-
-depend() {
- need net
-}
-
-start() {
- ebegin "Starting ldap-server"
- eval start-stop-daemon --start --quiet --pidfile /var/run/openldap/slapd.pid --exec /usr/lib/openldap/slapd -- -u ldap -g ldap "${OPTS}"
- eend $?
- if [ ! -e /var/lib/openldap-data/objectClass.bdb ]
- then
- sleep 5
- ldapadd -x -D "cn=Manager, o=Linux strongSwan, c=CH" -w tuxmux -f /etc/openldap/ldif.txt
- fi
-}
-
-stop() {
- ebegin "Stopping ldap-server"
- start-stop-daemon --stop --signal 2 --quiet --pidfile /var/run/openldap/slapd.pid
- eend $?
-}
diff --git a/testing/hosts/winnetou/etc/openldap/ldif.txt b/testing/hosts/winnetou/etc/ldap/ldif.txt
index 3eca4d6c6..d06621adb 100644
--- a/testing/hosts/winnetou/etc/openldap/ldif.txt
+++ b/testing/hosts/winnetou/etc/ldap/ldif.txt
@@ -28,7 +28,7 @@ cACertificate;binary:< file:///etc/openssl/research/researchCert.der
dn: ou=Sales, o=Linux strongSwan, c=CH
objectclass: organizationalUnit
-ou: Sales
+ou: Sales
dn: cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH
objectClass: organizationalRole
@@ -37,4 +37,3 @@ objectClass: certificationAuthority
authorityRevocationList;binary:< file:///etc/openssl/sales/sales.crl
certificateRevocationList;binary:< file:///etc/openssl/sales/sales.crl
cACertificate;binary:< file:///etc/openssl/sales/salesCert.der
-
diff --git a/testing/hosts/winnetou/etc/ldap/slapd.conf b/testing/hosts/winnetou/etc/ldap/slapd.conf
new file mode 100644
index 000000000..103d4573f
--- /dev/null
+++ b/testing/hosts/winnetou/etc/ldap/slapd.conf
@@ -0,0 +1,23 @@
+#
+# See slapd.conf(5) for details on configuration options.
+# This file should NOT be world readable.
+#
+
+moduleload back_bdb.la
+
+include /etc/ldap/schema/core.schema
+
+pidfile /var/run/openldap/slapd.pid
+argsfile /var/run/openldap/slapd.args
+
+#######################################################################
+# BDB database definitions
+#######################################################################
+
+database bdb
+suffix "o=Linux strongSwan,c=CH"
+rootdn "cn=Manager,o=Linux strongSwan,c=CH"
+checkpoint 32 30
+rootpw tuxmux
+directory /var/lib/ldap
+index objectClass eq
diff --git a/testing/hosts/winnetou/etc/network/interfaces b/testing/hosts/winnetou/etc/network/interfaces
new file mode 100644
index 000000000..7bfb6a9f2
--- /dev/null
+++ b/testing/hosts/winnetou/etc/network/interfaces
@@ -0,0 +1,12 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet static
+ address 192.168.0.150
+ netmask 255.255.255.0
+ broadcast 192.168.0.255
+ gateway 192.168.0.254
+iface eth0 inet6 static
+ address fec0::15
+ netmask 16
diff --git a/testing/hosts/winnetou/etc/openldap/slapd.conf b/testing/hosts/winnetou/etc/openldap/slapd.conf
deleted file mode 100644
index 5a99f955d..000000000
--- a/testing/hosts/winnetou/etc/openldap/slapd.conf
+++ /dev/null
@@ -1,68 +0,0 @@
-#
-# See slapd.conf(5) for details on configuration options.
-# This file should NOT be world readable.
-#
-include /etc/openldap/schema/core.schema
-
-# Define global ACLs to disable default read access.
-
-# Do not enable referrals until AFTER you have a working directory
-# service AND an understanding of referrals.
-#referral ldap://root.openldap.org
-
-pidfile /var/run/openldap/slapd.pid
-argsfile /var/run/openldap/slapd.args
-
-# Load dynamic backend modules:
-# modulepath /usr/lib/openldap/openldap
-# moduleload back_bdb.la
-# moduleload back_ldap.la
-# moduleload back_ldbm.la
-# moduleload back_passwd.la
-# moduleload back_shell.la
-
-# Sample security restrictions
-# Require integrity protection (prevent hijacking)
-# Require 112-bit (3DES or better) encryption for updates
-# Require 63-bit encryption for simple bind
-# security ssf=1 update_ssf=112 simple_bind=64
-
-# Sample access control policy:
-# Root DSE: allow anyone to read it
-# Subschema (sub)entry DSE: allow anyone to read it
-# Other DSEs:
-# Allow self write access
-# Allow authenticated users read access
-# Allow anonymous users to authenticate
-# Directives needed to implement policy:
-# access to dn.base="" by * read
-# access to dn.base="cn=Subschema" by * read
-# access to *
-# by self write
-# by users read
-# by anonymous auth
-#
-# if no access controls are present, the default policy
-# allows anyone and everyone to read anything but restricts
-# updates to rootdn. (e.g., "access to * by * read")
-#
-# rootdn can always read and write EVERYTHING!
-
-#######################################################################
-# BDB database definitions
-#######################################################################
-
-database bdb
-suffix "o=Linux strongSwan,c=CH"
-rootdn "cn=Manager,o=Linux strongSwan,c=CH"
-checkpoint 32 30 # <kbyte> <min>
-# Cleartext passwords, especially for the rootdn, should
-# be avoid. See slappasswd(8) and slapd.conf(5) for details.
-# Use of strong authentication encouraged.
-rootpw tuxmux
-# The database directory MUST exist prior to running slapd AND
-# should only be accessible by the slapd and slap tools.
-# Mode 700 recommended.
-directory /var/lib/openldap-data
-# Indices to maintain
-index objectClass eq
diff --git a/testing/hosts/winnetou/etc/openssl/generate-crl b/testing/hosts/winnetou/etc/openssl/generate-crl
index 60e53a0a4..839816bf5 100755
--- a/testing/hosts/winnetou/etc/openssl/generate-crl
+++ b/testing/hosts/winnetou/etc/openssl/generate-crl
@@ -16,30 +16,32 @@
export COMMON_NAME=strongSwan
+ROOT=/var/www
+
cd /etc/openssl
openssl ca -gencrl -crldays 30 -config /etc/openssl/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out strongswan.crl
-cp strongswan.crl /var/www/localhost/htdocs/
-cp strongswanCert.pem /var/www/localhost/htdocs/
-cp index.html /var/www/localhost/htdocs/
+cp strongswan.crl ${ROOT}
+cp strongswanCert.pem ${ROOT}
+cp index.html ${ROOT}
cd /etc/openssl/research
openssl ca -gencrl -crldays 15 -config /etc/openssl/research/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out research.crl
-cp research.crl /var/www/localhost/htdocs/
+cp research.crl ${ROOT}
cd /etc/openssl/sales
openssl ca -gencrl -crldays 15 -config /etc/openssl/sales/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out sales.crl
-cp sales.crl /var/www/localhost/htdocs/
+cp sales.crl ${ROOT}
cd /etc/openssl/ecdsa
openssl ca -gencrl -crldays 15 -config /etc/openssl/ecdsa/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out strongswan_ec.crl
-cp strongswan_ec.crl /var/www/localhost/htdocs/
+cp strongswan_ec.crl ${ROOT}
cd /etc/openssl/monster
openssl ca -gencrl -crldays 15 -config /etc/openssl/monster/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out strongswan-monster.crl
-cp strongswan-monster.crl /var/www/localhost/htdocs/
+cp strongswan-monster.crl ${ROOT}
cd /etc/openssl/rfc3779
openssl ca -gencrl -crldays 15 -config /etc/openssl/rfc3779/openssl.cnf -out crl.pem
openssl crl -in crl.pem -outform der -out strongswan_rfc3779.crl
-cp strongswan_rfc3779.crl /var/www/localhost/htdocs/
+cp strongswan_rfc3779.crl ${ROOT}
diff --git a/testing/hosts/winnetou/etc/openssl/index.html b/testing/hosts/winnetou/etc/openssl/index.html
index 1641768ae..8cbb2c482 100644
--- a/testing/hosts/winnetou/etc/openssl/index.html
+++ b/testing/hosts/winnetou/etc/openssl/index.html
@@ -20,10 +20,10 @@
</li>
</ul>
- <h2>strongSwan UML Testing Environment</h2>
+ <h2>strongSwan Testing Environment</h2>
<ul>
<li>
- <a href="testresults/">UML Test Results</a>
+ <a href="testresults/">Test Results</a>
</li>
</ul>
<a href="images/umlArchitecture_large.png" target="_blank">
diff --git a/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
index cb585ed08..a62fe16bd 100755
--- a/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
+++ b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -5,7 +5,7 @@ cd /etc/openssl
echo "Content-type: application/ocsp-response"
echo ""
-/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
- -rkey ocspKey.pem -rsigner ocspCert.pem \
- -nmin 5 \
- -reqin /dev/stdin -respout /dev/stdout
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+ -rkey ocspKey.pem -rsigner ocspCert.pem \
+ -nmin 5 \
+ -reqin /dev/stdin -respout /dev/stdout | cat
diff --git a/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi
index c193e8779..32405f81c 100755
--- a/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi
+++ b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi
@@ -5,7 +5,7 @@ cd /etc/openssl/research
echo "Content-type: application/ocsp-response"
echo ""
-/usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
- -rkey ocspKey.pem -rsigner ocspCert.pem \
- -nmin 5 \
- -reqin /dev/stdin -respout /dev/stdout
+cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
+ -rkey ocspKey.pem -rsigner ocspCert.pem \
+ -nmin 5 \
+ -reqin /dev/stdin -respout /dev/stdout | cat
diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi
index c53cb9a76..74a2aebc2 100755
--- a/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi
+++ b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi
@@ -5,7 +5,7 @@ cd /etc/openssl/sales
echo "Content-type: application/ocsp-response"
echo ""
-/usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
- -rkey ocspKey.pem -rsigner ocspCert.pem \
- -nmin 5 \
- -reqin /dev/stdin -respout /dev/stdout
+cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
+ -rkey ocspKey.pem -rsigner ocspCert.pem \
+ -nmin 5 \
+ -reqin /dev/stdin -respout /dev/stdout | cat
diff --git a/testing/hosts/winnetou/etc/runlevels/default/apache2 b/testing/hosts/winnetou/etc/runlevels/default/apache2
deleted file mode 100755
index 5f72d3090..000000000
--- a/testing/hosts/winnetou/etc/runlevels/default/apache2
+++ /dev/null
@@ -1,121 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2007 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="configtest fullstatus graceful gracefulstop modules reload"
-
-depend() {
- need net
- use mysql dns logger netmount postgresql
- after sshd
-}
-
-configtest() {
- ebegin "Checking Apache Configuration"
- checkconfig
- eend $?
-}
-
-checkconfig() {
- SERVERROOT="${SERVERROOT:-/usr/lib/apache2}"
- if [ ! -d ${SERVERROOT} ]; then
- eerror "SERVERROOT does not exist: ${SERVERROOT}"
- return 1
- fi
-
- CONFIGFILE="${CONFIGFILE:-/etc/apache2/httpd.conf}"
- [ "${CONFIGFILE#/}" = "${CONFIGFILE}" ] && CONFIGFILE="${SERVERROOT}/${CONFIGFILE}"
- if [ ! -r "${CONFIGFILE}" ]; then
- eerror "Unable to read configuration file: ${CONFIGFILE}"
- return 1
- fi
-
- APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}"
- APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}"
- [ -n "${STARTUPERRORLOG}" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}"
-
- APACHE2="/usr/sbin/apache2"
-
- ${APACHE2} ${APACHE2_OPTS} -t 1>/dev/null 2>&1
- ret=$?
- if [ $ret -ne 0 ]; then
- eerror "Apache2 has detected a syntax error in your configuration files:"
- ${APACHE2} ${APACHE2_OPTS} -t
- fi
-
- return $ret
-}
-
-start() {
- checkconfig || return 1
- ebegin "Starting apache2"
- [ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache
-
- start-stop-daemon --start --exec ${APACHE2} -- ${APACHE2_OPTS} -k start
- eend $?
-}
-
-stop() {
- checkconfig || return 1
- ebegin "Stopping apache2"
- start-stop-daemon --stop --retry -TERM/5/-KILL/5 --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
-}
-
-reload() {
- RELOAD_TYPE="${RELOAD_TYPE:-graceful}"
-
- checkconfig || return 1
- if [ "${RELOAD_TYPE}" = "restart" ]; then
- ebegin "Restarting apache2"
- start-stop-daemon --stop --oknodo --signal HUP --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
- elif [ "${RELOAD_TYPE}" = "graceful" ]; then
- ebegin "Gracefully restarting apache2"
- start-stop-daemon --stop --oknodo --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
- else
- eerror "${RELOAD_TYPE} is not a valid RELOAD_TYPE. Please edit /etc/conf.d/apache2"
- fi
-}
-
-graceful() {
- checkconfig || return 1
- ebegin "Gracefully restarting apache2"
- start-stop-daemon --stop --signal USR1 --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
-}
-
-gracefulstop() {
- checkconfig || return 1
-
- # zap!
- if service_started "${myservice}"; then
- mark_service_stopped "${myservice}"
- fi
-
- ebegin "Gracefully stopping apache2"
- # 28 is SIGWINCH
- start-stop-daemon --stop --signal 28 --exec ${APACHE2} --pidfile /var/run/apache2.pid
- eend $?
-}
-
-modules() {
- checkconfig || return 1
-
- ${APACHE2} ${APACHE2_OPTS} -M 2>&1
-}
-
-status() {
- LYNX="${LYNX:-lynx -dump}"
- STATUSURL="${STATUSURL:-http://localhost/server-status}"
-
- ${LYNX} ${STATUSURL} | awk ' /process$/ { print; exit } { print } '
-}
-
-fullstatus() {
- LYNX="${LYNX:-lynx -dump}"
- STATUSURL="${STATUSURL:-http://localhost/server-status}"
-
- ${LYNX} ${STATUSURL}
-}
diff --git a/testing/hosts/winnetou/etc/runlevels/default/net.eth0 b/testing/hosts/winnetou/etc/runlevels/default/net.eth0
deleted file mode 100755
index 92b3851cf..000000000
--- a/testing/hosts/winnetou/etc/runlevels/default/net.eth0
+++ /dev/null
@@ -1,1124 +0,0 @@
-#!/sbin/runscript
-# Copyright (c) 2004-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# Contributed by Roy Marples (uberlord@gentoo.org)
-# Many thanks to Aron Griffis (agriffis@gentoo.org)
-# for help, ideas and patches
-
-#NB: Config is in /etc/conf.d/net
-
-# For pcmcia users. note that pcmcia must be added to the same
-# runlevel as the net.* script that needs it.
-depend() {
- need localmount
- after bootmisc hostname
- use isapnp isdn pcmcia usb wlan
-
- # Load any custom depend functions for the given interface
- # For example, br0 may need eth0 and eth1
- local iface="${SVCNAME#*.}"
- [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface}
-
- if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then
- after net.lo net.lo0
-
- # Support new style RC_NEED and RC_USE in one net file
- local x="RC_NEED_${iface}"
- [[ -n ${!x} ]] && need ${!x}
- x="RC_USE_${iface}"
- [[ -n ${!x} ]] && use ${!x}
- fi
-
- return 0
-}
-
-# Define where our modules are
-MODULES_DIR="${svclib}/net"
-
-# Make some wrappers to fudge after/before/need/use depend flags.
-# These are callbacks so MODULE will be set.
-after() {
- eval "${MODULE}_after() { echo \"$*\"; }"
-}
-before() {
- eval "${MODULE}_before() { echo \"$*\"; }"
-}
-need() {
- eval "${MODULE}_need() { echo \"$*\"; }"
-}
-installed() {
- # We deliberately misspell this as _installed will probably be used
- # at some point
- eval "${MODULE}_instlled() { echo \"$*\"; }"
-}
-provide() {
- eval "${MODULE}_provide() { echo \"$*\"; }"
-}
-functions() {
- eval "${MODULE}_functions() { echo \"$*\"; }"
-}
-variables() {
- eval "${MODULE}_variables() { echo \"$*\"; }"
-}
-
-is_loopback() {
- [[ $1 == "lo" || $1 == "lo0" ]]
-}
-
-# char* interface_device(char *iface)
-#
-# Gets the base device of the interface
-# Can handle eth0:1 and eth0.1
-# Which returns eth0 in this case
-interface_device() {
- local dev="${1%%.*}"
- [[ ${dev} == "$1" ]] && dev="${1%%:*}"
- echo "${dev}"
-}
-
-# char* interface_type(char* iface)
-#
-# Returns the base type of the interface
-# eth, ippp, etc
-interface_type() {
- echo "${1%%[0-9]*}"
-}
-
-# int calculate_metric(char *interface, int base)
-#
-# Calculates the best metric for the interface
-# We use this when we add routes so we can prefer interfaces over each other
-calculate_metric() {
- local iface="$1" metric="$2"
-
- # Have we already got a metric?
- local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \
- /proc/net/route)
- if [[ -n ${m} ]] ; then
- echo "${m}"
- return 0
- fi
-
- local i= dest= gw= flags= ref= u= m= mtu= metrics=
- while read i dest gw flags ref u m mtu ; do
- # Ignore lo
- is_loopback "${i}" && continue
- # We work out metrics from default routes only
- [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue
- metrics="${metrics}\n${m}"
- done < /proc/net/route
-
- # Now, sort our metrics
- metrics=$(echo -e "${metrics}" | sort -n)
-
- # Now, find the lowest we can use
- local gotbase=false
- for m in ${metrics} ; do
- [[ ${m} -lt ${metric} ]] && continue
- [[ ${m} == ${metric} ]] && ((metric++))
- [[ ${m} -gt ${metric} ]] && break
- done
-
- echo "${metric}"
-}
-
-# int netmask2cidr(char *netmask)
-#
-# Returns the CIDR of a given netmask
-netmask2cidr() {
- local binary= i= bin=
-
- for i in ${1//./ }; do
- bin=""
- while [[ ${i} != "0" ]] ; do
- bin=$[${i}%2]${bin}
- (( i=i>>1 ))
- done
- binary="${binary}${bin}"
- done
- binary="${binary%%0*}"
- echo "${#binary}"
-}
-
-
-# bool is_function(char* name)
-#
-# Returns 0 if the given name is a shell function, otherwise 1
-is_function() {
- [[ -z $1 ]] && return 1
- [[ $(type -t "$1") == "function" ]]
-}
-
-# void function_wrap(char* source, char* target)
-#
-# wraps function calls - for example function_wrap(this, that)
-# maps function names this_* to that_*
-function_wrap() {
- local i=
-
- is_function "${2}_depend" && return
-
- for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do
- eval "${2}${i#${1}}() { ${i} \"\$@\"; }"
- done
-}
-
-# char[] * expand_parameters(char *cmd)
-#
-# Returns an array after expanding parameters. For example
-# "192.168.{1..3}.{1..3}/24 brd +"
-# will return
-# "192.168.1.1/24 brd +"
-# "192.168.1.2/24 brd +"
-# "192.168.1.3/24 brd +"
-# "192.168.2.1/24 brd +"
-# "192.168.2.2/24 brd +"
-# "192.168.2.3/24 brd +"
-# "192.168.3.1/24 brd +"
-# "192.168.3.2/24 brd +"
-# "192.168.3.3/24 brd +"
-expand_parameters() {
- local x=$(eval echo ${@// /_})
- local -a a=( ${x} )
-
- a=( "${a[@]/#/\"}" )
- a=( "${a[@]/%/\"}" )
- echo "${a[*]//_/ }"
-}
-
-# void configure_variables(char *interface, char *option1, [char *option2])
-#
-# Maps configuration options from <variable>_<option> to <variable>_<iface>
-# option2 takes precedence over option1
-configure_variables() {
- local iface="$1" option1="$2" option2="$3"
-
- local mod= func= x= i=
- local -a ivars=() ovars1=() ovars2=()
- local ifvar=$(bash_variable "${iface}")
-
- for mod in ${MODULES[@]}; do
- is_function ${mod}_variables || continue
- for v in $(${mod}_variables) ; do
- x=
- [[ -n ${option2} ]] && x="${v}_${option2}[@]"
- [[ -z ${!x} ]] && x="${v}_${option1}[@]"
- [[ -n ${!x} ]] && eval "${v}_${ifvar}=( \"\${!x}\" )"
- done
- done
-
- return 0
-}
-# bool module_load_minimum(char *module)
-#
-# Does the minimum checking on a module - even when forcing
-module_load_minimum() {
- local f="$1.sh" MODULE="${1##*/}"
-
- if [[ ! -f ${f} ]] ; then
- eerror "${f} does not exist"
- return 1
- fi
-
- if ! source "${f}" ; then
- eerror "${MODULE} failed a sanity check"
- return 1
- fi
-
- for f in depend; do
- is_function "${MODULE}_${f}" && continue
- eerror "${MODULE}.sh does not support the required function ${f}"
- return 1
- done
-
- return 0
-}
-
-# bool modules_load_auto()
-#
-# Load and check each module for sanity
-# If the module is not installed, the functions are to be removed
-modules_load_auto() {
- local i j inst
-
- # Populate the MODULES array
- # Basically we treat evey file in ${MODULES_DIR} as a module
- MODULES=( $( cd "${MODULES_DIR}" ; ls *.sh ) )
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES_DIR}/${MODULES[i]}"
- [[ ! -f ${MODULES[i]} ]] && unset MODULES[i]
- done
- MODULES=( "${MODULES[@]}" )
-
- # Each of these sources into the global namespace, so it's
- # important that module functions and variables are prefixed with
- # the module name, for example iproute2_
-
- j="${#MODULES[@]}"
- loaded_interface=false
- for (( i=0; i<j; i++ )); do
- MODULES[i]="${MODULES[i]%.sh*}"
- if [[ ${MODULES[i]##*/} == "interface" ]] ; then
- eerror "interface is a reserved name - cannot load a module called interface"
- return 1
- fi
-
- (
- u=0;
- module_load_minimum "${MODULES[i]}" || u=1;
- if [[ ${u} == 0 ]] ; then
- inst="${MODULES[i]##*/}_check_installed";
- if is_function "${inst}" ; then
- ${inst} false || u=1;
- fi
- fi
- exit "${u}";
- )
-
- if [[ $? == 0 ]] ; then
- source "${MODULES[i]}.sh"
- MODULES[i]="${MODULES[i]##*/}"
- else
- unset MODULES[i]
- fi
- done
-
- MODULES=( "${MODULES[@]}" )
- return 0
-}
-
-# bool modules_check_installed(void)
-#
-# Ensure that all modules have the required modules loaded
-# This enables us to remove modules from the MODULES array
-# Whilst other modules can still explicitly call them
-# One example of this is essidnet which configures network
-# settings for the specific ESSID connected to as the user
-# may be using a daemon to configure wireless instead of our
-# iwconfig module
-modules_check_installed() {
- local i j missingdeps nmods="${#MODULES[@]}"
-
- for (( i=0; i<nmods; i++ )); do
- is_function "${MODULES[i]}_instlled" || continue
- for j in $( ${MODULES[i]}_instlled ); do
- missingdeps=true
- if is_function "${j}_check_installed" ; then
- ${j}_check_installed && missingdeps=false
- elif is_function "${j}_depend" ; then
- missingdeps=false
- fi
- ${missingdeps} && unset MODULES[i] && unset PROVIDES[i] && break
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
-}
-
-# bool modules_check_user(void)
-modules_check_user() {
- local iface="$1" ifvar=$(bash_variable "${IFACE}")
- local i= j= k= l= nmods="${#MODULES[@]}"
- local -a umods=()
-
- # Has the interface got any specific modules?
- umods="modules_${ifvar}[@]"
- umods=( "${!umods}" )
-
- # Global setting follows interface-specific setting
- umods=( "${umods[@]}" "${modules[@]}" )
-
- # Add our preferred modules
- local -a pmods=( "iproute2" "dhcpcd" "iwconfig" "netplugd" )
- umods=( "${umods[@]}" "${pmods[@]}" )
-
- # First we strip any modules that conflict from user settings
- # So if the user specifies pump then we don't use dhcpcd
- for (( i=0; i<${#umods[@]}; i++ )); do
- # Some users will inevitably put "dhcp" in their modules
- # list. To keep users from screwing up their system this
- # way, ignore this setting so that the default dhcp
- # module will be used.
- [[ ${umods[i]} == "dhcp" ]] && continue
-
- # We remove any modules we explicitly don't want
- if [[ ${umods[i]} == "!"* ]] ; then
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${umods[i]:1} == "${MODULES[j]}" \
- || ${umods[i]:1} == "${PROVIDES[j]}" ]] ; then
- # We may need to setup a class wrapper for it even though
- # we don't use it directly
- # However, we put it into an array and wrap later as
- # another module may provide the same thing
- ${MODULES[j]}_check_installed \
- && WRAP_MODULES=(
- "${WRAP_MODULES[@]}"
- "${MODULES[j]} ${PROVIDES[j]}"
- )
- unset MODULES[j]
- unset PROVIDES[j]
- fi
- done
- continue
- fi
-
- if ! is_function "${umods[i]}_depend" ; then
- # If the module is one of our preferred modules, then
- # ignore this error; whatever is available will be
- # used instead.
- (( i < ${#umods[@]} - ${#pmods[@]} )) || continue
-
- # The function may not exist because the modules software is
- # not installed. Load the module and report its error
- if [[ -e "${MODULES_DIR}/${umods[i]}.sh" ]] ; then
- source "${MODULES_DIR}/${umods[i]}.sh"
- is_function "${umods[i]}_check_installed" \
- && ${umods[i]}_check_installed true
- else
- eerror "The module \"${umods[i]}\" does not exist"
- fi
- return 1
- fi
-
- if is_function "${umods[i]}_provide" ; then
- mod=$(${umods[i]}_provide)
- else
- mod="${umods[i]}"
- fi
- for (( j=0; j<nmods; j++ )); do
- [[ -z ${MODULES[j]} ]] && continue
- if [[ ${PROVIDES[j]} == "${mod}" && ${umods[i]} != "${MODULES[j]}" ]] ; then
- # We don't have a match - now ensure that we still provide an
- # alternative. This is to handle our preferred modules.
- for (( l=0; l<nmods; l++ )); do
- [[ ${l} == "${j}" || -z ${MODULES[l]} ]] && continue
- if [[ ${PROVIDES[l]} == "${mod}" ]] ; then
- unset MODULES[j]
- unset PROVIDES[j]
- break
- fi
- done
- fi
- done
- done
-
- # Then we strip conflicting modules.
- # We only need to do this for 3rd party modules that conflict with
- # our own modules and the preferred list AND the user modules
- # list doesn't specify a preference.
- for (( i=0; i<nmods-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( j=i+1; j<nmods; j++)); do
- [[ -z ${MODULES[j]} ]] && continue
- [[ ${PROVIDES[i]} == "${PROVIDES[j]}" ]] \
- && unset MODULES[j] && unset PROVIDES[j]
- done
- done
-
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- return 0
-}
-
-# void modules_sort(void)
-#
-# Sort our modules
-modules_sort() {
- local i= j= nmods=${#MODULES[@]} m=
- local -a provide=() provide_list=() after=() dead=() sorted=() sortedp=()
-
- # Make our provide list
- for ((i=0; i<nmods; i++)); do
- dead[i]="false"
- if [[ ${MODULES[i]} != "${PROVIDES[i]}" ]] ; then
- local provided=false
- for ((j=0; j<${#provide[@]}; j++)); do
- if [[ ${provide[j]} == "${PROVIDES[i]}" ]] ; then
- provide_list[j]="${provide_list[j]} ${MODULES[i]}"
- provided=true
- fi
- done
- if ! ${provided}; then
- provide[j]="${PROVIDES[i]}"
- provide_list[j]="${MODULES[i]}"
- fi
- fi
- done
-
- # Create an after array, which holds which modules the module at
- # index i must be after
- for ((i=0; i<nmods; i++)); do
- if is_function "${MODULES[i]}_after" ; then
- after[i]=" ${after[i]} $(${MODULES[i]}_after) "
- fi
- if is_function "${MODULES[i]}_before" ; then
- for m in $(${MODULES[i]}_before); do
- for ((j=0; j<nmods; j++)) ; do
- if [[ ${PROVIDES[j]} == "${m}" ]] ; then
- after[j]=" ${after[j]} ${MODULES[i]} "
- break
- fi
- done
- done
- fi
- done
-
- # Replace the after list modules with real modules
- for ((i=0; i<nmods; i++)); do
- if [[ -n ${after[i]} ]] ; then
- for ((j=0; j<${#provide[@]}; j++)); do
- after[i]="${after[i]// ${provide[j]} / ${provide_list[j]} }"
- done
- fi
- done
-
- # We then use the below code to provide a topologial sort
- module_after_visit() {
- local name="$1" i= x=
-
- for ((i=0; i<nmods; i++)); do
- [[ ${MODULES[i]} == "$1" ]] && break
- done
-
- ${dead[i]} && return
- dead[i]="true"
-
- for x in ${after[i]} ; do
- module_after_visit "${x}"
- done
-
- sorted=( "${sorted[@]}" "${MODULES[i]}" )
- sortedp=( "${sortedp[@]}" "${PROVIDES[i]}" )
- }
-
- for x in ${MODULES[@]}; do
- module_after_visit "${x}"
- done
-
- MODULES=( "${sorted[@]}" )
- PROVIDES=( "${sortedp[@]}" )
-}
-
-# bool modules_check_depends(bool showprovides)
-modules_check_depends() {
- local showprovides="${1:-false}" nmods="${#MODULES[@]}" i= j= needmod=
- local missingdeps= p= interface=false
-
- for (( i=0; i<nmods; i++ )); do
- if is_function "${MODULES[i]}_need" ; then
- for needmod in $(${MODULES[i]}_need); do
- missingdeps=true
- for (( j=0; j<nmods; j++ )); do
- if [[ ${needmod} == "${MODULES[j]}" \
- || ${needmod} == "${PROVIDES[j]}" ]] ; then
- missingdeps=false
- break
- fi
- done
- if ${missingdeps} ; then
- eerror "${MODULES[i]} needs ${needmod} (dependency failure)"
- return 1
- fi
- done
- fi
-
- if is_function "${MODULES[i]}_functions" ; then
- for f in $(${MODULES[i]}_functions); do
- if ! is_function "${f}" ; then
- eerror "${MODULES[i]}: missing required function \"${f}\""
- return 1
- fi
- done
- fi
-
- [[ ${PROVIDES[i]} == "interface" ]] && interface=true
-
- if ${showprovides} ; then
- [[ ${PROVIDES[i]} != "${MODULES[i]}" ]] \
- && veinfo "${MODULES[i]} provides ${PROVIDES[i]}"
- fi
- done
-
- if ! ${interface} ; then
- eerror "no interface module has been loaded"
- return 1
- fi
-
- return 0
-}
-
-# bool modules_load(char *iface, bool starting)
-#
-# Loads the defined handler and modules for the interface
-# Returns 0 on success, otherwise 1
-modules_load() {
- local iface="$1" starting="${2:-true}" MODULE= p=false i= j= k=
- local -a x=()
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a PROVIDES=() WRAP_MODULES=()
-
- if ! is_loopback "${iface}" ; then
- x="modules_force_${iface}[@]"
- [[ -n ${!x} ]] && modules_force=( "${!x}" )
- if [[ -n ${modules_force} ]] ; then
- ewarn "WARNING: You are forcing modules!"
- ewarn "Do not complain or file bugs if things start breaking"
- report=true
- fi
- fi
-
- veinfo "Loading networking modules for ${iface}"
- eindent
-
- if [[ -z ${modules_force} ]] ; then
- modules_load_auto || return 1
- else
- j="${#modules_force[@]}"
- for (( i=0; i<j; i++ )); do
- module_load_minimum "${MODULES_DIR}/${modules_force[i]}" || return 1
- if is_function "${modules_force[i]}_check_installed" ; then
- ${modules_force[i]}_check_installed || unset modules_force[i]
- fi
- done
- MODULES=( "${modules_force[@]}" )
- fi
-
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- # Now load our dependencies - we need to use the MODULE variable
- # here as the after/before/need functions use it
- MODULE="${MODULES[i]}"
- ${MODULE}_depend
-
- # expose does exactly the same thing as depend
- # However it is more "correct" as it exposes things to other modules
- # instead of depending on them ;)
- is_function "${MODULES[i]}_expose" && ${MODULES[i]}_expose
-
- # If no provide is given, assume module name
- if is_function "${MODULES[i]}_provide" ; then
- PROVIDES[i]=$(${MODULES[i]}_provide)
- else
- PROVIDES[i]="${MODULES[i]}"
- fi
- done
-
- if [[ -n ${modules_force[@]} ]] ; then
- # Strip any duplicate modules providing the same thing
- j="${#MODULES[@]}"
- for (( i=0; i<j-1; i++ )); do
- [[ -z ${MODULES[i]} ]] && continue
- for (( k=i+1; k<j; k++ )); do
- if [[ ${PROVIDES[i]} == ${PROVIDES[k]} ]] ; then
- unset MODULES[k]
- unset PROVIDES[k]
- fi
- done
- done
- MODULES=( "${MODULES[@]}" )
- PROVIDES=( "${PROVIDES[@]}" )
- else
- if ${starting}; then
- modules_check_user "${iface}" || return 1
- else
- # Always prefer iproute2 for taking down interfaces
- if is_function iproute2_provide ; then
- function_wrap iproute2 "$(iproute2_provide)"
- fi
- fi
- fi
-
- # Wrap our modules
- j="${#MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap "${MODULES[i]}" "${PROVIDES[i]}"
- done
- j="${#WRAP_MODULES[@]}"
- for (( i=0; i<j; i++ )); do
- function_wrap ${WRAP_MODULES[i]}
- done
-
- if [[ -z ${modules_force[@]} ]] ; then
- modules_check_installed || return 1
- modules_sort || return 1
- fi
-
- veinfo "modules: ${MODULES[@]}"
- eindent
-
- ${starting} && p=true
- modules_check_depends "${p}" || return 1
- return 0
-}
-
-# bool iface_start(char *interface)
-#
-# iface_start is called from start. It's expected to start the base
-# interface (for example "eth0"), aliases (for example "eth0:1") and to start
-# VLAN interfaces (for example eth0.0, eth0.1). VLAN setup is accomplished by
-# calling itself recursively.
-iface_start() {
- local iface="$1" mod config_counter="-1" x config_worked=false
- local RC_INDENTATION="${RC_INDENTATION}"
- local -a config=() fallback=() fallback_route=() conf=() a=() b=()
- local ifvar=$(bash_variable "$1") i= j= metric=0
-
- # pre Start any modules with
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_start" ; then
- ${mod}_pre_start "${iface}" || { eend 1; return 1; }
- fi
- done
-
- x="metric_${ifvar}"
- # If we don't have a metric then calculate one
- # Our modules will set the metric variable to a suitable base
- # in their pre starts.
- if [[ -z ${!x} ]] ; then
- eval "metric_${ifvar}=\"$(calculate_metric "${iface}" "${metric}")\""
- fi
-
- # We now expand the configuration parameters and pray that the
- # fallbacks expand to the same number as config or there will be
- # trouble!
- a="config_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- config=( "${config[@]}" "${b[@]}" )
- done
-
- a="fallback_${ifvar}[@]"
- a=( "${!a}" )
- for (( i=0; i<${#a[@]}; i++ )); do
- eval b=( $(expand_parameters "${a[i]}") )
- fallback=( "${fallback[@]}" "${b[@]}" )
- done
-
- # We don't expand routes
- fallback_route="fallback_route_${ifvar}[@]"
- fallback_route=( "${!fallback_route}" )
-
- # We must support old configs
- if [[ -z ${config} ]] ; then
- interface_get_old_config "${iface}" || return 1
- if [[ -n ${config} ]] ; then
- ewarn "You are using a deprecated configuration syntax for ${iface}"
- ewarn "You are advised to read /etc/conf.d/net.example and upgrade it accordingly"
- fi
- fi
-
- # Handle "noop" correctly
- if [[ ${config[0]} == "noop" ]] ; then
- if interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- return 0
- fi
-
- # Remove noop from the config var
- config=( "${config[@]:1}" )
- fi
-
- # Provide a default of DHCP if no configuration is set and we're auto
- # Otherwise a default of NULL
- if [[ -z ${config} ]] ; then
- ewarn "Configuration not set for ${iface} - assuming DHCP"
- if is_function "dhcp_start" ; then
- config=( "dhcp" )
- else
- eerror "No DHCP client installed"
- return 1
- fi
- fi
-
- einfo "Bringing up ${iface}"
- eindent
- for (( config_counter=0; config_counter<${#config[@]}; config_counter++ )); do
- # Handle null and noop correctly
- if [[ ${config[config_counter]} == "null" \
- || ${config[config_counter]} == "noop" ]] ; then
- eend 0
- config_worked=true
- continue
- fi
-
- # We convert it to an array - this has the added
- # bonus of trimming spaces!
- conf=( ${config[config_counter]} )
- einfo "${conf[0]}"
-
- # Do we have a function for our config?
- if is_function "${conf[0]}_start" ; then
- eindent
- ${conf[0]}_start "${iface}" ; x=$?
- eoutdent
- [[ ${x} == 0 ]] && config_worked=true && continue
- # We need to test to see if it's an IP address or a function
- # We do this by testing if the 1st character is a digit
- elif [[ ${conf[0]:0:1} == [[:digit:]] || ${conf[0]} == *:* ]] ; then
- x="0"
- if ! is_loopback "${iface}" ; then
- if [[ " ${MODULES[@]} " == *" arping "* ]] ; then
- if arping_address_exists "${iface}" "${conf[0]}" ; then
- eerror "${conf[0]%%/*} already taken on ${iface}"
- x="1"
- fi
- fi
- fi
- [[ ${x} == "0" ]] && interface_add_address "${iface}" ${conf[@]}; x="$?"
- eend "${x}" && config_worked=true && continue
- else
- if [[ ${conf[0]} == "dhcp" ]] ; then
- eerror "No DHCP client installed"
- else
- eerror "No loaded modules provide \"${conf[0]}\" (${conf[0]}_start)"
- fi
- fi
-
- if [[ -n ${fallback[config_counter]} ]] ; then
- einfo "Trying fallback configuration"
- config[config_counter]="${fallback[config_counter]}"
- fallback[config_counter]=""
-
- # Do we have a fallback route?
- if [[ -n ${fallback_route[config_counter]} ]] ; then
- x="fallback_route[config_counter]"
- eval "routes_${ifvar}=( \"\${!x}\" )"
- fallback_route[config_counter]=""
- fi
-
- (( config_counter-- )) # since the loop will increment it
- continue
- fi
- done
- eoutdent
-
- # We return failure if no configuration parameters worked
- ${config_worked} || return 1
-
- # Start any modules with _post_start
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_post_start" ; then
- ${mod}_post_start "${iface}" || return 1
- fi
- done
-
- return 0
-}
-
-# bool iface_stop(char *interface)
-#
-# iface_stop: bring down an interface. Don't trust information in
-# /etc/conf.d/net since the configuration might have changed since
-# iface_start ran. Instead query for current configuration and bring
-# down the interface.
-iface_stop() {
- local iface="$1" i= aliases= need_begin=false mod=
- local RC_INDENTATION="${RC_INDENTATION}"
-
- # pre Stop any modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_pre_stop" ; then
- ${mod}_pre_stop "${iface}" || return 1
- fi
- done
-
- einfo "Bringing down ${iface}"
- eindent
-
- # Collect list of aliases for this interface.
- # List will be in reverse order.
- if interface_exists "${iface}" ; then
- aliases=$(interface_get_aliases_rev "${iface}")
- fi
-
- # Stop aliases before primary interface.
- # Note this must be done in reverse order, since ifconfig eth0:1
- # will remove eth0:2, etc. It might be sufficient to simply remove
- # the base interface but we're being safe here.
- for i in ${aliases} ${iface}; do
- # Stop all our modules
- for mod in ${MODULES[@]}; do
- if is_function "${mod}_stop" ; then
- ${mod}_stop "${i}" || return 1
- fi
- done
-
- # A module may have removed the interface
- if ! interface_exists "${iface}" ; then
- eend 0
- continue
- fi
-
- # We don't delete ppp assigned addresses
- if ! is_function pppd_exists || ! pppd_exists "${i}" ; then
- # Delete all the addresses for this alias
- interface_del_addresses "${i}"
- fi
-
- # Do final shut down of this alias
- if [[ ${IN_BACKGROUND} != "true" \
- && ${RC_DOWN_INTERFACE} == "yes" ]] ; then
- ebegin "Shutting down ${i}"
- interface_iface_stop "${i}"
- eend "$?"
- fi
- done
-
- # post Stop any modules
- for mod in ${MODULES[@]}; do
- # We have already taken down the interface, so no need to error
- is_function "${mod}_post_stop" && ${mod}_post_stop "${iface}"
- done
-
- return 0
-}
-
-# bool run_start(char *iface)
-#
-# Brings up ${IFACE}. Calls preup, iface_start, then postup.
-# Returns 0 (success) unless preup or iface_start returns 1 (failure).
-# Ignores the return value from postup.
-# We cannot check that the device exists ourselves as modules like
-# tuntap make create it.
-run_start() {
- local iface="$1" IFVAR=$(bash_variable "$1")
-
- # We do this so users can specify additional addresses for lo if they
- # need too - additional routes too
- # However, no extra modules are loaded as they are just not needed
- if [[ ${iface} == "lo" ]] ; then
- metric_lo="0"
- config_lo=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo=( "127.0.0.0/8" "${routes_lo[@]}" )
- elif [[ ${iface} == "lo0" ]] ; then
- metric_lo0="0"
- config_lo0=( "127.0.0.1/8 brd 127.255.255.255" "${config_lo[@]}" )
- routes_lo0=( "127.0.0.0/8" "${routes_lo[@]}" )
- fi
-
- # We may not have a loaded module for ${iface}
- # Some users may have "alias natsemi eth0" in /etc/modules.d/foo
- # so we can work with this
- # However, if they do the same with eth1 and try to start it
- # but eth0 has not been loaded then the module gets loaded as
- # eth0.
- # Not much we can do about this :(
- # Also, we cannot error here as some modules - such as bridge
- # create interfaces
- if ! interface_exists "${iface}" ; then
- /sbin/modprobe "${iface}" &>/dev/null
- fi
-
- # Call user-defined preup function if it exists
- if is_function preup ; then
- einfo "Running preup function"
- eindent
- ( preup "${iface}" )
- eend "$?" "preup ${iface} failed" || return 1
- eoutdent
- fi
-
- # If config is set to noop and the interface is up with an address
- # then we don't start it
- local config=
- config="config_${IFVAR}[@]"
- config=( "${!config}" )
- if [[ ${config[0]} == "noop" ]] && interface_is_up "${iface}" true ; then
- einfo "Keeping current configuration for ${iface}"
- eend 0
- else
- # Remove noop from the config var
- [[ ${config[0]} == "noop" ]] \
- && eval "config_${IFVAR}=( "\"\$\{config\[@\]:1\}\"" )"
-
- # There may be existing ip address info - so we strip it
- if [[ ${RC_INTERFACE_KEEP_CONFIG} != "yes" \
- && ${IN_BACKGROUND} != "true" ]] ; then
- interface_del_addresses "${iface}"
- fi
-
- # Start the interface
- if ! iface_start "${iface}" ; then
- if [[ ${IN_BACKGROUND} != "true" ]] ; then
- interface_exists "${iface}" && interface_down "${iface}"
- fi
- eend 1
- return 1
- fi
- fi
-
- # Call user-defined postup function if it exists
- if is_function postup ; then
- # We need to mark the service as started incase a
- # postdown function wants to restart services that depend on us
- mark_service_started "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postup function"
- eindent
- ( postup "${iface}" )
- eoutdent
- fi
-
- return 0
-}
-
-# bool run_stop(char *iface) {
-#
-# Brings down ${iface}. If predown call returns non-zero, then
-# stop returns non-zero to indicate failure bringing down device.
-# In all other cases stop returns 0 to indicate success.
-run_stop() {
- local iface="$1" IFVAR=$(bash_variable "$1") x
-
- # Load our ESSID variable so users can use it in predown() instead
- # of having to write code.
- local ESSID=$(get_options ESSID) ESSIDVAR=
- [[ -n ${ESSID} ]] && ESSIDVAR=$(bash_variable "${ESSID}")
-
- # Call user-defined predown function if it exists
- if is_function predown ; then
- einfo "Running predown function"
- eindent
- ( predown "${iface}" )
- eend $? "predown ${iface} failed" || return 1
- eoutdent
- elif is_net_fs / ; then
- eerror "root filesystem is network mounted -- can't stop ${iface}"
- return 1
- elif is_union_fs / ; then
- for x in $(unionctl "${dir}" --list \
- | sed -e 's/^\(.*\) .*/\1/') ; do
- if is_net_fs "${x}" ; then
- eerror "Part of the root filesystem is network mounted - cannot stop ${iface}"
- return 1
- fi
- done
- fi
-
- iface_stop "${iface}" || return 1 # always succeeds, btw
-
- # Release resolv.conf information.
- [[ -x /sbin/resolvconf ]] && resolvconf -d "${iface}"
-
- # Mark us as inactive if called from the background
- [[ ${IN_BACKGROUND} == "true" ]] && mark_service_inactive "net.${iface}"
-
- # Call user-defined postdown function if it exists
- if is_function postdown ; then
- # We need to mark the service as stopped incase a
- # postdown function wants to restart services that depend on us
- [[ ${IN_BACKGROUND} != "true" ]] && mark_service_stopped "net.${iface}"
- end_service "net.${iface}" 0
- einfo "Running postdown function"
- eindent
- ( postdown "${iface}" )
- eoutdent
- fi
-
-
- return 0
-}
-
-# bool run(char *iface, char *cmd)
-#
-# Main start/stop entry point
-# We load modules here and remove any functions that they
-# added as we may be called inside the same shell scope for another interface
-run() {
- local iface="$1" cmd="$2" r=1 RC_INDENTATION="${RC_INDENTATION}"
- local starting=true
- local -a MODULES=() mods=()
- local IN_BACKGROUND="${IN_BACKGROUND}"
-
- if [[ ${IN_BACKGROUND} == "true" || ${IN_BACKGROUND} == "1" ]] ; then
- IN_BACKGROUND=true
- else
- IN_BACKGROUND=false
- fi
-
- # We need to override the exit function as runscript.sh now checks
- # for it. We need it so we can mark the service as inactive ourselves.
- unset -f exit
-
- eindent
- [[ ${cmd} == "stop" ]] && starting=false
-
- # We force lo to only use these modules for a major speed boost
- if is_loopback "${iface}" ; then
- modules_force=( "iproute2" "ifconfig" "system" )
- fi
-
- if modules_load "${iface}" "${starting}" ; then
- if [[ ${cmd} == "stop" ]] ; then
- # Reverse the module list for stopping
- mods=( "${MODULES[@]}" )
- for ((i = 0; i < ${#mods[@]}; i++)); do
- MODULES[i]=${mods[((${#mods[@]} - i - 1))]}
- done
-
- run_stop "${iface}" && r=0
- else
- # Only hotplug on ethernet interfaces
- if [[ ${IN_HOTPLUG} == 1 ]] ; then
- if ! interface_is_ethernet "${iface}" ; then
- eerror "We only hotplug for ethernet interfaces"
- return 1
- fi
- fi
-
- run_start "${iface}" && r=0
- fi
- fi
-
- if [[ ${r} != "0" ]] ; then
- if [[ ${cmd} == "start" ]] ; then
- # Call user-defined failup if it exists
- if is_function failup ; then
- einfo "Running failup function"
- eindent
- ( failup "${iface}" )
- eoutdent
- fi
- else
- # Call user-defined faildown if it exists
- if is_function faildown ; then
- einfo "Running faildown function"
- eindent
- ( faildown "${iface}" )
- eoutdent
- fi
- fi
- [[ ${IN_BACKGROUND} == "true" ]] \
- && mark_service_inactive "net.${iface}"
- fi
-
- return "${r}"
-}
-
-# bool start(void)
-#
-# Start entry point so that we only have one function
-# which localises variables and unsets functions
-start() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Starting ${IFACE}"
- run "${IFACE}" start
-}
-
-# bool stop(void)
-#
-# Stop entry point so that we only have one function
-# which localises variables and unsets functions
-stop() {
- declare -r IFACE="${SVCNAME#*.}"
- einfo "Stopping ${IFACE}"
- run "${IFACE}" stop
-}
-
-# vim:ts=4
diff --git a/testing/make-testing b/testing/make-testing
index 7cd3324e0..84ac20bf2 100755
--- a/testing/make-testing
+++ b/testing/make-testing
@@ -1,87 +1,27 @@
#!/bin/bash
-# Create the strongSwan UML testing environment
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-DIR=`dirname $0`
+DIR=$(dirname `readlink -f $0`)
+. $DIR/testing.conf
-source $DIR/scripts/function.sh
+rm -f $LOGFILE
+mkdir -p $BUILDDIR
-[ -f $DIR/testing.conf ] || die "!! Configuration file 'testing.conf' not found."
-
-source $DIR/testing.conf
-
-if [ "$#" -eq 0 ]
-then
- HOSTS=$STRONGSWANHOSTS
-else
- HOSTS=$*
-fi
-
-##########################################################################
-# build the UML kernel based on a vanilla kernel form kernel.org
-# and a matching UML patch from user-mode-linux.sourceforge.net
-#
-if [ $ENABLE_BUILD_UMLKERNEL = "yes" ]
-then
- cecho "Building uml kernel (scripts/build-umlkernel)"
- $DIR/scripts/build-umlkernel
-fi
-
-##########################################################################
-# Adding the ssh RSA public keys to ~/.ssh/known_hosts
-#
-if [ $ENABLE_BUILD_SSHKEYS = "yes" ]
-then
- cecho "Adding ssh public keys of the uml instances (scripts/build-sshkeys)"
- $DIR/scripts/build-sshkeys
-fi
-
-##########################################################################
-# copy the default UML host configurations to $BUILDDIR
-# and assign actual IP addresses to the UML hosts
-#
-if [ $ENABLE_BUILD_HOSTCONFIG = "yes" ]
+if [ $ENABLE_BUILD_BASEIMAGE = "yes" ]
then
- cecho "Building host configurations (scripts/build-hostconfig)"
- $DIR/scripts/build-hostconfig
+ $DIR/scripts/build-baseimage || exit 1
fi
-##########################################################################
-# build a generic UML root file system based on a Gentoo root file system.
-# compile and install a specified strongSwan release into the file system.
-#
-if [ $ENABLE_BUILD_UMLROOTFS = "yes" ]
+if [ $ENABLE_BUILD_ROOTIMAGE = "yes" ]
then
- cecho "Building uml root file system with strongSwan (scripts/build-umlrootfs)"
- $DIR/scripts/build-umlrootfs
+ $DIR/scripts/build-rootimage || exit 1
fi
-##########################################################################
-# Creating the root filesystems for the specified UML instances
-#
-if [ $ENABLE_BUILD_UMLHOSTFS = "yes" ]
+if [ $ENABLE_BUILD_GUESTKERNEL = "yes" ]
then
- cecho "Building uml host root file systems (scripts/build-umlhostfs)"
- $DIR/scripts/build-umlhostfs $HOSTS
+ $DIR/scripts/build-guestkernel || exit 1
fi
-##########################################################################
-# Start up the UML switches and designated UML instances
-#
-if [ $ENABLE_START_TESTING = "yes" ]
+if [ $ENABLE_BUILD_GUESTIMAGES = "yes" ]
then
- cecho "Starting the uml switches and instances (start-testing)"
- $DIR/start-testing $HOSTS
+ $DIR/scripts/build-guestimages $HOSTS || exit 1
fi
diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage
new file mode 100755
index 000000000..1355d7a05
--- /dev/null
+++ b/testing/scripts/build-baseimage
@@ -0,0 +1,79 @@
+#!/bin/bash
+
+echo "Building base image"
+
+DIR=$(dirname `readlink -f $0`)
+. $DIR/../testing.conf
+. $DIR/function.sh
+
+[ `id -u` -eq 0 ] || die "You must be root to run $0"
+
+check_commands debootstrap mkfs.ext3 partprobe qemu-img qemu-nbd sfdisk
+
+# package includes/excludes
+INC=build-essential,gperf,libgmp-dev,libldap2-dev,libcurl4-openssl-dev,ethtool
+INC=$INC,libxml2-dev,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc
+INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libxerces-c2-dev,libltdl-dev
+INC=$INC,liblog4cxx10-dev,libboost-thread-dev,libboost-system-dev,git-core
+INC=$INC,less,acpid,acpi-support-base
+SERVICES="apache2 dbus isc-dhcp-server slapd"
+INC=$INC,${SERVICES// /,}
+EXC=iptables
+
+CACHEDIR=$BUILDDIR/cache
+APTCACHE=$LOOPDIR/var/cache/apt/archives
+
+mkdir -p $LOOPDIR
+mkdir -p $CACHEDIR
+mkdir -p $IMGDIR
+rm -f $BASEIMG
+
+echo "`date`, building $BASEIMG" >>$LOGFILE
+
+load_qemu_nbd
+
+log_action "Creating base image $BASEIMG"
+execute "qemu-img create -f $IMGEXT $BASEIMG ${BASEIMGSIZE}M"
+
+log_action "Connecting image to NBD device $NBDEV"
+execute "qemu-nbd -c $NBDEV $BASEIMG"
+do_on_exit qemu-nbd -d $NBDEV
+
+log_action "Partitioning disk"
+sfdisk /dev/nbd0 -D -uM >>$LOGFILE 2>&1 << EOF
+;
+EOF
+if [ $? != 0 ]
+then
+ log_status 1
+ exit 1
+else
+ log_status 0
+fi
+partprobe $NBDEV
+
+log_action "Creating ext3 filesystem"
+execute "mkfs.ext3 $NBDPARTITION"
+
+log_action "Mounting $NBDPARTITION to $LOOPDIR"
+execute "mount $NBDPARTITION $LOOPDIR"
+do_on_exit graceful_umount $LOOPDIR
+
+log_action "Using $CACHEDIR as archive for apt"
+mkdir -p $APTCACHE
+execute "mount -o bind $CACHEDIR $APTCACHE"
+do_on_exit graceful_umount $APTCACHE
+
+log_action "Running debootstrap ($BASEIMGSUITE, $BASEIMGARCH)"
+execute "debootstrap --arch=$BASEIMGARCH --include=$INC --exclude $EXC $BASEIMGSUITE $LOOPDIR $BASEIMGMIRROR"
+
+for service in $SERVICES
+do
+ log_action "Stopping service $service"
+ execute_chroot "/etc/init.d/$service stop"
+ log_action "Disabling service $service"
+ execute_chroot "update-rc.d -f $service remove"
+done
+
+log_action "Disabling root password"
+execute_chroot "passwd -d root"
diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages
new file mode 100755
index 000000000..f5669040e
--- /dev/null
+++ b/testing/scripts/build-guestimages
@@ -0,0 +1,65 @@
+#!/bin/bash
+# create specific guest images
+#
+# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
+# Zuercher Hochschule Winterthur
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at your
+# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+# for more details.
+
+echo "Creating guest images"
+
+DIR=$(dirname `readlink -f $0`)
+. $DIR/../testing.conf
+. $DIR/function.sh
+
+HOSTSDIR=$DIR/../hosts
+
+[ `id -u` -eq 0 ] || die "You must be root to run $0"
+[ -f $ROOTIMG ] || die "Root image $ROOTIMG not found"
+[ -f $HOSTDIR ] || die "Hosts directory $HOSTSDIR not found"
+
+check_commands partprobe qemu-img qemu-nbd
+
+load_qemu_nbd
+
+mkdir -p $IMGDIR
+mkdir -p $LOOPDIR
+
+# just to be sure
+do_on_exit qemu-nbd -d $NBDEV
+do_on_exit umount $LOOPDIR
+
+for host in $STRONGSWANHOSTS
+do
+ log_action "Creating guest image for $host"
+ execute "qemu-img create -b $ROOTIMG -f $IMGEXT $IMGDIR/$host.$IMGEXT" 0
+ execute "qemu-nbd -c $NBDEV $IMGDIR/$host.$IMGEXT" 0
+ partprobe $NBDEV
+ execute "mount $NBDPARTITION $LOOPDIR" 0
+ execute "cp -rf $HOSTSDIR/${host}/etc $LOOPDIR" 0
+ execute "cp -rf $HOSTSDIR/default/* $LOOPDIR" 0
+ if [ "$host" = "winnetou" ]
+ then
+ execute "mkdir $LOOPDIR/var/log/apache2/ocsp" 0
+ execute "cp -rf $DIR/../images $LOOPDIR/var/www/" 0
+ execute_chroot "ln -s /etc/openssl/certs /var/www/certs" 0
+ execute_chroot "/etc/openssl/generate-crl" 0
+ execute_chroot "update-rc.d apache2 defaults" 0
+ execute_chroot "update-rc.d slapd defaults" 0
+ execute_chroot "rm -rf /var/lib/ldap/*" 0
+ execute_chroot "slapadd -l /etc/ldap/ldif.txt -f /etc/ldap/slapd.conf" 0
+ execute_chroot "chown -R openldap:openldap /var/lib/ldap" 0
+ fi
+ sync
+ execute "umount $LOOPDIR" 0
+ execute "qemu-nbd -d $NBDEV" 0
+ log_status 0
+done
diff --git a/testing/scripts/build-guestkernel b/testing/scripts/build-guestkernel
new file mode 100755
index 000000000..66a9fe7a4
--- /dev/null
+++ b/testing/scripts/build-guestkernel
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+DIR=$(dirname `readlink -f $0`)
+. $DIR/../testing.conf
+. $DIR/function.sh
+
+echo "Building guest kernel version $KERNELVERSION"
+
+[ -f "$KERNELCONFIG" ] || die "Kernel config $KERNELCONFIG not found"
+
+check_commands bunzip2 bzcat make wget
+
+cd $BUILDDIR
+
+if [ ! -f "$KERNELTARBALL" ]
+then
+ url=ftp://ftp.kernel.org/pub/linux/kernel/v3.x/$KERNELTARBALL
+ log_action "Downloading $url"
+ execute "wget -q $url"
+fi
+
+if [[ $KERNELPATCH && ! -f "$KERNELPATCH" ]]
+then
+ url=http://download.strongswan.org/uml/$KERNELPATCH
+ log_action "Downloading $url"
+ execute "wget -q $url"
+fi
+
+log_action "Unpacking kernel"
+execute "tar xjf $KERNELTARBALL"
+
+KERNELDIR=$BUILDDIR/$KERNEL
+cd $KERNELDIR
+
+if [ $KERNELPATCH ]
+then
+ log_action "Applying kernel patch"
+ bzcat ../$KERNELPATCH | patch -p1 >>$LOGFILE 2>&1
+ log_status $?
+ [ $? -eq 0 ] || exit 1
+fi
+
+execute "cp $KERNELCONFIG .config" 0
+
+echo "Creating kernel configuration, you might get prompted for new parameters"
+make oldconfig 2>&1 | tee -a $LOGFILE
+
+log_action "Compiling the kernel"
+execute "make -j5"
diff --git a/testing/scripts/build-hostconfig b/testing/scripts/build-hostconfig
deleted file mode 100755
index 0ebbc5264..000000000
--- a/testing/scripts/build-hostconfig
+++ /dev/null
@@ -1,122 +0,0 @@
-#!/bin/bash
-# build the hosts configuration directory with the actual IP addresses
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found"
-[ -d $DIR/../hosts ] || die "!! Directory 'hosts' not found"
-
-source $DIR/../testing.conf
-
-if [ ! -d $BUILDDIR ]
-then
- cecho " * Creating directory '$BUILDDIR'"
- mkdir $BUILDDIR
-fi
-
-########################################
-# copy default host configs to $BUILDDIR
-#
-
-HOSTCONFIGDIR=${BUILDDIR}/hosts
-
-if [ -d $HOSTCONFIGDIR ]
-then
- rm -r $HOSTCONFIGDIR
-fi
-
-mkdir $HOSTCONFIGDIR
-cp -rfp ${UMLTESTDIR}/testing/hosts $BUILDDIR
-
-cecho " * Copied default host config directory to '$HOSTCONFIGDIR'"
-
-########################################
-# assign IP for each host to hostname
-#
-
-cecho-n " * Generate default config for.."
-
-HOSTIP=`ifconfig eth0 |grep inet |sed -e "s/.*inet addr://" -e "s/ Bcast.*//"`
-
-for host in $STRONGSWANHOSTS
-do
- cecho-n "${host}.."
- eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
- eval ipv6_${host}="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
-
- [ "`eval echo \\\$ipv4_${host}`" != "$HOSTIP" ] || die "$host has the same IP as eth0 (Host)! Please change that."
-
- case $host in
- moon)
- eval ipv4_moon1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- [ "`eval echo \\\$ipv4_moon1`" != "$HOSTIP" ] || die "eth1 of $host has the same IP as eth0 (Host)! Please change that."
- searchandreplace PH_IP_MOON1 $ipv4_moon1 $HOSTCONFIGDIR
- searchandreplace PH_IP_MOON $ipv4_moon $HOSTCONFIGDIR
- eval ipv6_moon1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- searchandreplace PH_IP6_MOON1 $ipv6_moon1 $HOSTCONFIGDIR
- searchandreplace PH_IP6_MOON $ipv6_moon $HOSTCONFIGDIR
- ;;
- sun)
- eval ipv4_sun1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- [ "`eval echo \\\$ipv4_sun1`" != "$HOSTIP" ] || die "eth1 of $host has the same IP as eth0 (Host)! Please change that."
- searchandreplace PH_IP_SUN1 $ipv4_sun1 $HOSTCONFIGDIR
- searchandreplace PH_IP_SUN $ipv4_sun $HOSTCONFIGDIR
- eval ipv6_sun1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- searchandreplace PH_IP6_SUN1 $ipv6_sun1 $HOSTCONFIGDIR
- searchandreplace PH_IP6_SUN $ipv6_sun $HOSTCONFIGDIR
- ;;
- alice)
- eval ipv4_alice1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- searchandreplace PH_IP_ALICE1 $ipv4_alice1 $HOSTCONFIGDIR
- searchandreplace PH_IP_ALICE $ipv4_alice $HOSTCONFIGDIR
- eval ipv6_alice1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- searchandreplace PH_IP6_ALICE1 $ipv6_alice1 $HOSTCONFIGDIR
- searchandreplace PH_IP6_ALICE $ipv6_alice $HOSTCONFIGDIR
- ;;
- venus)
- searchandreplace PH_IP_VENUS $ipv4_venus $HOSTCONFIGDIR
- searchandreplace PH_IP6_VENUS $ipv6_venus $HOSTCONFIGDIR
- ;;
- bob)
- searchandreplace PH_IP_BOB $ipv4_bob $HOSTCONFIGDIR
- searchandreplace PH_IP6_BOB $ipv6_bob $HOSTCONFIGDIR
- ;;
- carol)
- eval ipv4_carol1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- searchandreplace PH_IP_CAROL1 $ipv4_carol1 $HOSTCONFIGDIR
- searchandreplace PH_IP_CAROL $ipv4_carol $HOSTCONFIGDIR
- eval ipv6_carol1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- searchandreplace PH_IP6_CAROL1 $ipv6_carol1 $HOSTCONFIGDIR
- searchandreplace PH_IP6_CAROL $ipv6_carol $HOSTCONFIGDIR
- ;;
- dave)
- eval ipv4_dave1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- searchandreplace PH_IP_DAVE1 $ipv4_dave1 $HOSTCONFIGDIR
- searchandreplace PH_IP_DAVE $ipv4_dave $HOSTCONFIGDIR
- eval ipv6_dave1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
- searchandreplace PH_IP6_DAVE1 $ipv6_dave1 $HOSTCONFIGDIR
- searchandreplace PH_IP6_DAVE $ipv6_dave $HOSTCONFIGDIR
- ;;
- winnetou)
- searchandreplace PH_IP_WINNETOU $ipv4_winnetou $HOSTCONFIGDIR
- searchandreplace PH_IP6_WINNETOU $ipv6_winnetou $HOSTCONFIGDIR
- ;;
- esac
-done
-
-cgecho "done"
diff --git a/testing/scripts/build-rootimage b/testing/scripts/build-rootimage
new file mode 100755
index 000000000..8e10ce5f3
--- /dev/null
+++ b/testing/scripts/build-rootimage
@@ -0,0 +1,67 @@
+#!/bin/bash
+# Create guest root image
+#
+# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
+# Zuercher Hochschule Winterthur
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at your
+# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+# for more details.
+
+echo "Building root image"
+
+DIR=$(dirname `readlink -f $0`)
+. $DIR/../testing.conf
+. $DIR/function.sh
+
+[ `id -u` -eq 0 ] || die "You must be root to run $0"
+[ -f "$BASEIMG" ] || die "Base image $BASEIMG not found"
+
+check_commands partprobe qemu-img qemu-nbd
+
+load_qemu_nbd
+
+mkdir -p $LOOPDIR
+mkdir -p $SHAREDDIR/compile
+mkdir -p $IMGDIR
+
+log_action "Creating root image $ROOTIMG"
+execute "qemu-img create -b $BASEIMG -f $IMGEXT $ROOTIMG"
+
+log_action "Connecting root image to NBD device $NBDEV"
+execute "qemu-nbd -c $NBDEV $ROOTIMG"
+do_on_exit qemu-nbd -d $NBDEV
+partprobe $NBDEV
+
+log_action "Mounting $NBDPARTITION to $LOOPDIR"
+execute "mount $NBDPARTITION $LOOPDIR"
+do_on_exit umount $LOOPDIR
+
+log_action "Mounting proc filesystem to $LOOPDIR/proc"
+execute "mount -t proc none $LOOPDIR/proc"
+do_on_exit umount $LOOPDIR/proc
+
+mkdir -p $LOOPDIR/root/shared
+log_action "Mounting $SHAREDDIR as /root/shared"
+execute "mount -o bind $SHAREDDIR $LOOPDIR/root/shared"
+do_on_exit umount $LOOPDIR/root/shared
+
+echo "Installing software from source"
+RECPDIR=$DIR/recipes
+RECIPES=`ls $RECPDIR/*.mk | xargs -n1 basename`
+execute "cp -r $RECPDIR/patches $LOOPDIR/root/shared/compile" 0
+for r in $RECIPES
+do
+ cp $RECPDIR/$r ${LOOPDIR}/root/shared/compile
+ log_action "Installing from recipe $r"
+ execute_chroot "make SWANVERSION=$SWANVERSION -C /root/shared/compile -f $r"
+done
+
+log_action "Removing /etc/resolv.conf"
+execute "rm -f $LOOPDIR/etc/resolv.conf"
diff --git a/testing/scripts/build-sshkeys b/testing/scripts/build-sshkeys
deleted file mode 100755
index 799078557..000000000
--- a/testing/scripts/build-sshkeys
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/bin/bash
-# build the hosts configuration directory with the actual IP addresses
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found"
-[ -d $DIR/../hosts ] || die "!! Directory 'hosts' not found"
-
-source $DIR/../testing.conf
-
-if [ ! -d $BUILDDIR ]
-then
- cecho " * Creating directory '$BUILDDIR'"
- mkdir $BUILDDIR
-fi
-
-LOGFILE=${BUILDDIR}/testing.log
-
-if [ ! -f $LOGFILE ]
-then
- cecho-n " * Logfile '$LOGFILE' does not exist..creating.."
- touch $LOGFILE
- cgecho "done"
-fi
-
-if [ ! -d ~/.ssh ]
-then
- cecho-n " * Creating directory '~/.ssh'.."
- mkdir ~/.ssh
- cgecho "done"
-fi
-
-if [ -f ~/.ssh/known_hosts ]
-then
- cecho-n " * Backing up ~/.ssh/known_hosts to '~/.ssh/known_hosts.before_uml'.."
- cp -fp ~/.ssh/known_hosts ~/.ssh/known_hosts.before_uml
- cgecho "done"
-else
- cecho-n " * Creating '~/.ssh/known_hosts'"
- touch ~/.ssh/known_hosts
- cgecho "done"
-fi
-
-for host in $HOSTNAMEIPV4
-do
- HOSTNAME=`echo $host | awk -F, '{ print $1 }'`
- IP=`echo $host | awk -F, '{ print $2 }'`
- if [ `grep "$IP " ~/.ssh/known_hosts | wc -l` != "0" ]
- then
- cecho "!! Warning: An entry exists for the following IP address: $IP"
- else
- cecho-n " * Adding uml host $HOSTNAME ($IP) to '~/.ssh/known_hosts'.."
- echo "$HOSTNAME,$IP `cat $DIR/../hosts/ssh_host_rsa_key.pub`" >> ~/.ssh/known_hosts
- cgecho "done"
- fi
-done
-
-#####################################
-# preparing ssh for PK authentication
-#
-
-cecho-n " * Checking for ssh rsa key '~/.ssh/id_rsa.pub'.."
-if [ -f ~/.ssh/id_rsa.pub ]
-then
- cecho "already exists"
-else
- cecho "not found"
- cecho-n " * Generating ssh rsa key pair.."
- echo "" | ssh-keygen -N "" -t rsa -f ~/.ssh/id_rsa >> $LOGFILE 2>&1
- cgecho "done"
-fi
diff --git a/testing/scripts/build-umlhostfs b/testing/scripts/build-umlhostfs
deleted file mode 100755
index 75feaa4ed..000000000
--- a/testing/scripts/build-umlhostfs
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/bin/bash
-# create UML host file systems
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found."
-
-source $DIR/../testing.conf
-
-cd $BUILDDIR/root-fs
-
-[ -f gentoo-fs ] || die "!! Root file system 'gentoo-fs' not found."
-
-if [ ! -d $BUILDDIR ]
-then
- cecho-n " * Directory '$BUILDDIR' does not exist..creating.."
- mkdir $BUILDDIR
- cgecho "done"
-fi
-
-LOGFILE=${BUILDDIR}/testing.log
-
-if [ ! -f $LOGFILE ]
-then
- cecho-n " * Logfile '$LOGFILE' does not exist..creating.."
- touch $LOGFILE
- cgecho "done"
-fi
-
-LOOPDIR=loop
-
-if [ ! -d $LOOPDIR ]
-then
- mkdir $LOOPDIR
-fi
-
-cecho-n " * Creating root filesystem for.."
-
-if [ "$#" -eq 0 ]
-then
- HOSTS=$STRONGSWANHOSTS
-else
- HOSTS=$*
-fi
-
-for host in $HOSTS
-do
- cecho-n "$host.."
- cp gentoo-fs gentoo-fs-$host
- mount -o loop gentoo-fs-$host $LOOPDIR
- cp -rf $BUILDDIR/hosts/${host}/etc $LOOPDIR
- if [ "$host" = "winnetou" ]
- then
- mkdir $LOOPDIR/var/log/apache2/ocsp
- cp -rf $UMLTESTDIR/testing/images $LOOPDIR/var/www/localhost/htdocs
- chroot $LOOPDIR ln -s /etc/openssl/certs /var/www/localhost/htdocs/certs
- chroot $LOOPDIR /etc/openssl/generate-crl >> $LOGFILE 2>&1
- fi
- chroot $LOOPDIR /etc/init.d/depscan.sh --update >> $LOGFILE 2>&1
- umount $LOOPDIR
-done
-
-cgecho "done"
diff --git a/testing/scripts/build-umlkernel b/testing/scripts/build-umlkernel
deleted file mode 100755
index b9f0d710d..000000000
--- a/testing/scripts/build-umlkernel
+++ /dev/null
@@ -1,130 +0,0 @@
-#!/bin/bash
-# build an UML kernel based on a vanilla kernel and UML patch
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-cecho-n " * Looking for kernel at '$KERNEL'.."
-if [ -f "${KERNEL}" ]
-then
- cecho "found it"
- KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'`
- cecho " * Kernel version is $KERNELVERSION"
-else
- cecho "none"
- exit
-fi
-
-if [ ${UMLPATCH} ]
-then
- cecho-n " * Looking for uml patch at '$UMLPATCH'.."
- if [ -f "${UMLPATCH}" ]
- then
- cecho "found it"
- else
- cecho "none"
- exit
- fi
-fi
-
-cecho-n " * Looking for kernel config at '$KERNELCONFIG'.."
-if [ -f "${KERNEL}" ]
-then
- cecho "found it"
-else
- cecho "none"
- exit
-fi
-
-#######################################################
-# unpack kernel and create symlink
-#
-
-if [ ! -d $BUILDDIR ]
-then
- cecho " * Creating directory '$BUILDDIR'"
- mkdir $BUILDDIR
-fi
-
-cecho " * Changing to directory '$BUILDDIR'"
-cd $BUILDDIR
-
-LOGFILE=${BUILDDIR}/testing.log
-
-if [ ! -f $LOGFILE ]
-then
- cecho-n " * Logfile '$LOGFILE' does not exist..creating.."
- touch $LOGFILE
- cgecho "done"
-fi
-
-cecho-n " * Unpacking kernel.."
-tar xjf $KERNEL >> $LOGFILE 2>&1
-cgecho "done"
-
-KERNELDIR=${BUILDDIR}/linux-${KERNELVERSION}
-
-if [ -d $KERNELDIR ]
-then
- cecho " * Kernel directory is '$KERNELDIR'"
- cecho " * Creating symlink 'linux'"
- if [ -d linux ]
- then
- rm linux
- fi
- ln -s linux-${KERNELVERSION} linux
-else
- cecho "!! Kernel directory '$KERNELDIR' can not be found"
- exit
-fi
-
-#######################################################
-# patch kernel
-#
-
-cecho " * Changing to directory '$KERNELDIR'"
-cd $KERNELDIR
-
-if [ $UMLPATCH ]
-then
- cecho-n " * Applying uml patch.."
- bzcat $UMLPATCH | patch -p1 >> $LOGFILE 2>&1
- cgecho "done"
-fi
-
-#######################################################
-# copy our default .config to linux and build kernel
-#
-
-cp $KERNELCONFIG .config
-
-cecho "!!"
-cecho "!! Making .config for kernel. You might be prompted for new parameters!"
-cecho "!!"
-make oldconfig ARCH=um SUBARCH=i386 2>&1 | tee -a $LOGFILE
-
-cecho-n " * Now compiling uml kernel.."
-make linux ARCH=um SUBARCH=i386 >> $LOGFILE 2>&1
-cgecho "done"
-
-cecho-n " * Copying uml kernel to '${BUILDDIR}/linux-uml-${KERNELVERSION}'.."
-mv linux ${BUILDDIR}/linux-uml-${KERNELVERSION}
-cgecho "done"
diff --git a/testing/scripts/build-umlrootfs b/testing/scripts/build-umlrootfs
deleted file mode 100755
index 92595222c..000000000
--- a/testing/scripts/build-umlrootfs
+++ /dev/null
@@ -1,451 +0,0 @@
-#!/bin/bash
-# Create UML root filesystem
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "!! Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-STRONGSWANVERSION=`basename $STRONGSWAN .tar.bz2`
-
-cecho-n " * Looking for strongSwan at '$STRONGSWAN'.."
-if [ -f "$STRONGSWAN" ]
-then
- cecho "found it"
- cecho " * strongSwan version is '$STRONGSWANVERSION'"
-else
- cecho "none"
- exit
-fi
-
-cecho-n " * Looking for gentoo root filesystem at '$ROOTFS'.."
-if [ -f "$ROOTFS" ]
-then
- cecho "found it"
-else
- cecho "none"
- exit
-fi
-
-[ -d $BUILDDIR ] || die "!! Directory '$BUILDDIR' does not exist"
-
-HOSTCONFIGDIR=$BUILDDIR/hosts
-
-[ -d $HOSTCONFIGDIR ] || die "!! Directory '$HOSTCONFIGDIR' does not exist"
-
-LOGFILE=$BUILDDIR/testing.log
-
-if [ ! -f $LOGFILE ]
-then
- cecho-n " * Logfile '$LOGFILE' does not exist..creating.."
- touch $LOGFILE
- cgecho "done"
-fi
-
-ROOTFSDIR=$BUILDDIR/root-fs
-
-if [ ! -d $ROOTFSDIR ]
-then
- cecho-n " * Root file system directory '$ROOTFSDIR' does not exist..creating.."
- mkdir $ROOTFSDIR
- cgecho "done"
-fi
-
-cd $ROOTFSDIR
-
-LOOPDIR=$ROOTFSDIR/loop
-
-if [ ! -d $LOOPDIR ]
-then
- mkdir $LOOPDIR
-fi
-
-######################################################
-# creating reiser-based uml root filesystem
-#
-
-cecho-n " * Building basic root filesystem (gentoo).."
-dd if=/dev/zero of=gentoo-fs count=$ROOTFSSIZE bs=1M >> $LOGFILE 2>&1
-mkreiserfs -q -f gentoo-fs >> $LOGFILE 2>&1
-mount -o loop gentoo-fs $LOOPDIR >> $LOGFILE 2>&1
-tar xjpf $ROOTFS -C $LOOPDIR >> $LOGFILE 2>&1
-cgecho "done"
-
-######################################################
-# remove /etc/resolv.conf
-#
-cecho " * Removing /etc/resolv.conf"
-rm -f $LOOPDIR/etc/resolv.conf
-
-######################################################
-# copying default /etc/hosts to the root filesystem
-#
-cecho " * Copying '$HOSTCONFIGDIR/default/etc/hosts' to the root filesystem"
-cp -fp $HOSTCONFIGDIR/default/etc/hosts $LOOPDIR/etc/hosts
-
-#####################################################
-# extracting strongSwan into the root filesystem
-#
-cecho " * Extracting strongSwan into the root filesystem"
-tar xjf $STRONGSWAN -C $LOOPDIR/root >> $LOGFILE 2>&1
-
-######################################################
-# setting up mountpoint for shared source tree
-#
-if [ "${SHAREDTREE+set}" = "set" ]; then
- cecho " * setting up shared strongswan tree at '$SHAREDTREE'"
- mkdir $LOOPDIR/root/strongswan-shared
- echo "" >> $LOOPDIR/etc/fstab
- echo "none /root/strongswan-shared hostfs $SHAREDTREE" >> $LOOPDIR/etc/fstab
-fi
-
-######################################################
-# installing strongSwan and setting the local timezone
-#
-
-INSTALLSHELL=${LOOPDIR}/install.sh
-
-cecho " * Preparing strongSwan installation script"
-echo "ln -sf /usr/share/zoneinfo/${TZUML} /etc/localtime" >> $INSTALLSHELL
-
-echo "cd /root/${STRONGSWANVERSION}" >> $INSTALLSHELL
-echo -n "./configure --sysconfdir=/etc" >> $INSTALLSHELL
-echo -n " --with-random-device=/dev/urandom" >> $INSTALLSHELL
-echo -n " --disable-load-warning" >> $INSTALLSHELL
-
-if [ "$USE_LIBCURL" = "yes" ]
-then
- echo -n " --enable-curl" >> $INSTALLSHELL
-fi
-
-if [ "$USE_LDAP" = "yes" ]
-then
- echo -n " --enable-ldap" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_AKA" = "yes" ]
-then
- echo -n " --enable-eap-aka" >> $INSTALLSHELL
- echo -n " --enable-eap-aka-3gpp2" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_SIM" = "yes" ]
-then
- echo -n " --enable-eap-sim" >> $INSTALLSHELL
- echo -n " --enable-eap-sim-file" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_MD5" = "yes" ]
-then
- echo -n " --enable-eap-md5" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_MSCHAPV2" = "yes" ]
-then
- echo -n " --enable-md4" >> $INSTALLSHELL
- echo -n " --enable-eap-mschapv2" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_IDENTITY" = "yes" ]
-then
- echo -n " --enable-eap-identity" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_RADIUS" = "yes" ]
-then
- echo -n " --enable-eap-radius" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_DYNAMIC" = "yes" ]
-then
- echo -n " --enable-eap-dynamic" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_TLS" = "yes" ]
-then
- echo -n " --enable-eap-tls" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_TTLS" = "yes" ]
-then
- echo -n " --enable-eap-ttls" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_PEAP" = "yes" ]
-then
- echo -n " --enable-eap-peap" >> $INSTALLSHELL
-fi
-
-if [ "$USE_EAP_TNC" = "yes" ]
-then
- echo -n " --enable-eap-tnc" >> $INSTALLSHELL
-fi
-
-if [ "$USE_TNC_PDP" = "yes" ]
-then
- echo -n " --enable-tnc-pdp" >> $INSTALLSHELL
-fi
-
-if [ "$USE_TNC_IMC" = "yes" ]
-then
- echo -n " --enable-tnc-imc" >> $INSTALLSHELL
-fi
-
-if [ "$USE_TNC_IMV" = "yes" ]
-then
- echo -n " --enable-tnc-imv" >> $INSTALLSHELL
-fi
-
-if [ "$USE_TNCCS_11" = "yes" ]
-then
- echo -n " --enable-tnccs-11" >> $INSTALLSHELL
-fi
-
-if [ "$USE_TNCCS_20" = "yes" ]
-then
- echo -n " --enable-tnccs-20" >> $INSTALLSHELL
-fi
-
-if [ "$USE_TNCCS_DYNAMIC" = "yes" ]
-then
- echo -n " --enable-tnccs-dynamic" >> $INSTALLSHELL
-fi
-
-if [ "$USE_IMC_TEST" = "yes" ]
-then
- echo -n " --enable-imc-test" >> $INSTALLSHELL
-fi
-
-if [ "$USE_IMV_TEST" = "yes" ]
-then
- echo -n " --enable-imv-test" >> $INSTALLSHELL
-fi
-
-if [ "$USE_IMC_SCANNER" = "yes" ]
-then
- echo -n " --enable-imc-scanner" >> $INSTALLSHELL
-fi
-
-if [ "$USE_IMV_SCANNER" = "yes" ]
-then
- echo -n " --enable-imv-scanner" >> $INSTALLSHELL
-fi
-
-if [ "$USE_IMC_ATTESTATION" = "yes" ]
-then
- echo -n " --enable-imc-attestation" >> $INSTALLSHELL
-fi
-
-if [ "$USE_IMV_ATTESTATION" = "yes" ]
-then
- echo -n " --enable-imv-attestation" >> $INSTALLSHELL
-fi
-
-if [ "$USE_SQL" = "yes" ]
-then
- echo -n " --enable-sql --enable-sqlite" >> $INSTALLSHELL
- fi
-
-if [ "$USE_MEDIATION" = "yes" ]
-then
- echo -n " --enable-mediation" >> $INSTALLSHELL
-fi
-
-if [ "$USE_OPENSSL" = "yes" ]
-then
- echo -n " --enable-openssl" >> $INSTALLSHELL
-fi
-
-if [ "$USE_BLOWFISH" = "yes" ]
-then
- echo -n " --enable-blowfish" >> $INSTALLSHELL
-fi
-
-if [ "$USE_KERNEL_PFKEY" = "yes" ]
-then
- echo -n " --enable-kernel-pfkey" >> $INSTALLSHELL
-fi
-
-if [ "$USE_INTEGRITY_TEST" = "yes" ]
-then
- echo -n " --enable-integrity-test" >> $INSTALLSHELL
-fi
-
-if [ "$USE_LEAK_DETECTIVE" = "yes" ]
-then
- echo -n " --enable-leak-detective" >> $INSTALLSHELL
-fi
-
-if [ "$USE_LOAD_TESTER" = "yes" ]
-then
- echo -n " --enable-load-tester" >> $INSTALLSHELL
-fi
-
-if [ "$USE_TEST_VECTORS" = "yes" ]
-then
- echo -n " --enable-test-vectors" >> $INSTALLSHELL
-fi
-
-if [ "$USE_GCRYPT" = "yes" ]
-then
- echo -n " --enable-gcrypt" >> $INSTALLSHELL
-fi
-
-if [ "$USE_SOCKET_DEFAULT" = "yes" ]
-then
- echo -n " --enable-socket-default" >> $INSTALLSHELL
-fi
-
-if [ "$USE_SOCKET_DYNAMIC" = "yes" ]
-then
- echo -n " --enable-socket-dynamic" >> $INSTALLSHELL
-fi
-
-if [ "$USE_DHCP" = "yes" ]
-then
- echo -n " --enable-dhcp" >> $INSTALLSHELL
-fi
-
-if [ "$USE_FARP" = "yes" ]
-then
- echo -n " --enable-farp" >> $INSTALLSHELL
-fi
-
-if [ "$USE_ADDRBLOCK" = "yes" ]
-then
- echo -n " --enable-addrblock" >> $INSTALLSHELL
-fi
-
-if [ "$USE_CTR" = "yes" ]
-then
- echo -n " --enable-ctr" >> $INSTALLSHELL
-fi
-
-if [ "$USE_CCM" = "yes" ]
-then
- echo -n " --enable-ccm" >> $INSTALLSHELL
-fi
-
-if [ "$USE_GCM" = "yes" ]
-then
- echo -n " --enable-gcm" >> $INSTALLSHELL
-fi
-
-if [ "$USE_CMAC" = "yes" ]
-then
- echo -n " --enable-cmac" >> $INSTALLSHELL
-fi
-
-if [ "$USE_HA" = "yes" ]
-then
- echo -n " --enable-ha" >> $INSTALLSHELL
-fi
-
-if [ "$USE_AF_ALG" = "yes" ]
-then
- echo -n " --enable-af-alg" >> $INSTALLSHELL
-fi
-
-if [ "$USE_WHITELIST" = "yes" ]
-then
- echo -n " --enable-whitelist" >> $INSTALLSHELL
-fi
-
-if [ "$USE_XAUTH_GENERIC" = "yes" ]
-then
- echo -n " --enable-xauth-generic" >> $INSTALLSHELL
-fi
-
-if [ "$USE_XAUTH_EAP" = "yes" ]
-then
- echo -n " --enable-xauth-eap" >> $INSTALLSHELL
-fi
-
-if [ "$USE_PKCS8" = "yes" ]
-then
- echo -n " --enable-pkcs8" >> $INSTALLSHELL
-fi
-
-if [ "$USE_IFMAP" = "yes" ]
-then
- echo -n " --enable-tnc-ifmap" >> $INSTALLSHELL
-fi
-
-if [ "$USE_CISCO_QUIRKS" = "yes" ]
-then
- echo -n " --enable-cisco-quirks" >> $INSTALLSHELL
-fi
-
-if [ "$USE_UNITY" = "yes" ]
-then
- echo -n " --enable-unity" >> $INSTALLSHELL
-fi
-
-echo "" >> $INSTALLSHELL
-echo "make -j" >> $INSTALLSHELL
-echo "make install" >> $INSTALLSHELL
-echo "ldconfig" >> $INSTALLSHELL
-
-cecho-n " * Compiling $STRONGSWANVERSION within the root file system as chroot.."
-chroot $LOOPDIR /bin/bash /install.sh >> $LOGFILE 2>&1
-rm -f $INSTALLSHELL
-cgecho "done"
-
-######################################################
-# copying default /etc/ipsec.d/tables.sql to the root filesystem
-#
-cecho " * Copying '$HOSTCONFIGDIR/default/etc/ipsec.d/tables.sql' to the root filesystem"
-cp -fp $HOSTCONFIGDIR/default/etc/ipsec.d/tables.sql $LOOPDIR/etc/ipsec.d/tables.sql
-
-######################################################
-# copying the host's ssh public key
-#
-
-if [ ! -d $LOOPDIR/root/.ssh ]
-then
- mkdir $LOOPDIR/root/.ssh
-fi
-cp ~/.ssh/id_rsa.pub $LOOPDIR/root/.ssh/authorized_keys
-
-######################################################
-# setup public key based login among all hosts
-#
-cp $LOOPDIR/etc/ssh/ssh_host_rsa_key $LOOPDIR/root/.ssh/id_rsa
-
-for host in $STRONGSWANHOSTS
-do
- eval ip="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F- '{ print $1 }' | awk '{ print $1 }'`"
- echo "$host,$ip `cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub`" >> $LOOPDIR/root/.ssh/known_hosts
- echo "`cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub` root@$host" >> $LOOPDIR/root/.ssh/authorized_keys
-done
-
-######################################################
-# defining an empty modules.dep
-#
-
-if [ $UMLPATCH ]
-then
- mkdir $LOOPDIR/lib/modules/`basename $UMLPATCH .bz2 | sed s/uml-patch-//`um
- touch $LOOPDIR/lib/modules/`basename $UMLPATCH .bz2 | sed s/uml-patch-//`um/modules.dep
-else
- mkdir $LOOPDIR/lib/modules/$KERNELVERSION
- touch $LOOPDIR/lib/modules/$KERNELVERSION/modules.dep
-fi
-
-umount $LOOPDIR
diff --git a/testing/scripts/function.sh b/testing/scripts/function.sh
index e7ecbcf83..c4769678c 100755
--- a/testing/scripts/function.sh
+++ b/testing/scripts/function.sh
@@ -14,31 +14,146 @@
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
+export TERM=xterm
+RED=$(tput setaf 1)
+GREEN=$(tput setaf 2)
+NORMAL=$(tput op)
-############################################
-# print output in color
-#
+# exit with given error message
+# $1 - error message
+die() {
+ echo -e "${RED}$1${NORMAL}"
+ exit 1
+}
-function cecho {
- echo -e "\033[1;31m$1\033[0m"
+# execute command
+# $1 - command to execute
+# $2 - whether or not to log command exit status
+# (0 -> disable exit status logging)
+execute()
+{
+ cmd=${1}
+ echo $cmd >>$LOGFILE 2>&1
+ $cmd >>$LOGFILE 2>&1
+ status=$?
+ [ "$2" != 0 ] && log_status $status
+ if [ $status != 0 ]; then
+ echo
+ echo "! Command $cmd failed, exiting (status $status)"
+ echo "! Check why here $LOGFILE"
+ exit 1
+ fi
}
-function cgecho {
- echo -e "\033[1;32m$1\033[0m"
+
+# execute command in chroot
+# $1 - command to execute
+execute_chroot()
+{
+ execute "chroot $LOOPDIR $@"
}
-function cecho-n {
- echo -en "\033[1;31m$1\033[0m"
+# write green status message to console
+# $1 - msg
+echo_ok()
+{
+ echo -e "${GREEN}$1${NORMAL}"
}
+# write red status message to console
+# $1 - msg
+echo_failed()
+{
+ echo -e "${RED}$1${NORMAL}"
+}
-#############################################
-# output all args to stderr and exit with
-# return code 1
-#
+# log an action
+# $1 - current action description
+log_action()
+{
+ /bin/echo -n "[....] $1 "
+}
-die() {
- echo $* 1>&2
- exit 1
+# log an action status
+# $1 - exit status of action
+log_status()
+{
+ tput hpa 0
+ if [ $1 -eq 0 ]; then
+ /bin/echo -ne "[${GREEN} ok ${NORMAL}"
+ else
+ /bin/echo -ne "[${RED}FAIL${NORMAL}"
+ fi
+ echo
+}
+
+# the following two functions are stolen from [1]
+# [1] - http://www.linuxjournal.com/content/use-bash-trap-statement-cleanup-temporary-files
+
+declare -a on_exit_items
+
+# perform registered actions on exit
+on_exit()
+{
+ for ((onex=${#on_exit_items[@]}-1; onex>=0; onex--))
+ do
+ echo "On_Exit: ${on_exit_items[$onex]}" >>$LOGFILE
+ ${on_exit_items[$onex]} >>$LOGFILE 2>&1
+ done
+ on_exit_items=""
+ trap - EXIT
+}
+
+# register a command to execute when the calling script terminates. The
+# registered commands are called in FILO order.
+# $* - command to register
+do_on_exit()
+{
+ local n=${#on_exit_items[*]}
+ on_exit_items[$n]="$*"
+ if [ $n -eq 0 ]; then
+ trap on_exit EXIT
+ fi
+}
+
+# wait for a mount to disappear
+# $1 - device/image to wait for
+# $2 - maximum time to wait in seconds, default is 5 seconds
+graceful_umount()
+{
+ secs=$2
+ [ ! $secs ] && secs=5
+
+ let steps=$secs*100
+ for st in `seq 1 $steps`
+ do
+ umount $1 >>$LOGFILE 2>&1
+ mount | grep $1 >/dev/null 2>&1
+ [ $? -eq 0 ] || return 0
+ sleep 0.01
+ done
+
+ return 1
+}
+
+# load qemu NBD kernel module, if not already loaded
+load_qemu_nbd()
+{
+ lsmod | grep ^nbd[[:space:]]* >/dev/null 2>&1
+ if [ $? != 0 ]
+ then
+ log_action "Loading NBD kernel module"
+ execute "modprobe nbd max_part=16"
+ fi
+}
+
+# check if given commands exist in $PATH
+# $* - commands to check
+check_commands()
+{
+ for i in $*
+ do
+ command -v $i >/dev/null || { die "Required command $i not found"; exit 1; }
+ done
}
#############################################
@@ -55,13 +170,6 @@ function searchandreplace {
[ -d "$DESTDIR" ] || die "$DESTDIR is not a directory!"
- #########################
- # create a temporary file
- #
-
- TMPFILE="/tmp/sr.$$"
-
-
###########################################
# search and replace in each found file the
# given string
@@ -69,59 +177,7 @@ function searchandreplace {
for eachfoundfile in `find $DESTDIR -type f`
do
- sed -e "s/$SEARCHSTRING/$REPLACESTRING/g" "$eachfoundfile" > "$TMPFILE"
- cp -f "$TMPFILE" "$eachfoundfile"
+ sed -i -e "s/$SEARCHSTRING/$REPLACESTRING/g" "$eachfoundfile"
done
-
- ###########################
- # delete the temporary file
- #
-
- rm -f "$TMPFILE"
-
-}
-
-#############################################
-# add a bridge
-#
-
-function umlbr_add {
- brctl addbr "umlbr$1"
- brctl setfd "umlbr$1" 0
- brctl setageing "umlbr$1" 3600
- brctl stp "umlbr$1" off
- ifconfig "umlbr$1" "$2" netmask "$3" up
}
-
-#############################################
-# delete a bridge
-#
-
-function umlbr_del {
- ifconfig "umlbr$1" down &> /dev/null 2>&1
- brctl delbr "umlbr$1" &> /dev/null 2>&1
-}
-
-#############################################
-# add a tap interface to a bridge
-#
-
-function umlbr_add_tap {
- tunctl -t "tap$1_$2" &> /dev/null 2>&1
- ifconfig "tap$1_$2" 0.0.0.0 promisc up &> /dev/null 2>&1
- brctl addif "umlbr$1" "tap$1_$2" &> /dev/null 2>&1
- cecho-n "$2.."
- }
-
-#############################################
-# delete a tap interface from a bridge
-#
-
-function umlbr_del_tap {
- ifconfig "umlbr$2" down &> /dev/null 2>&1
- brctl delif "umlbr$1" "tap$1_$2" &> /dev/null 2>&1
- tunctl -d "tap$1_$2" &> /dev/null 2>&1
- cecho-n "$2.."
- }
-
diff --git a/testing/scripts/gstart-umls b/testing/scripts/gstart-umls
deleted file mode 100755
index c6fcd26dc..000000000
--- a/testing/scripts/gstart-umls
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/bin/bash
-# starts the UML instances in an gnome-terminal (requires X11R6)
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-if [ "$#" -eq 0 ]
-then
- HOSTS=$STRONGSWANHOSTS
-else
- HOSTS=$*
-fi
-
-BOOTING_HOSTS=""
-count_max=12
-count=0
-
-#position of xterm window on the desktop
-x0=8
-y0=52
-dx=12
-dy=24
-
-for host in $HOSTS
-do
- up=0
-
- if [ -d ~/.uml/${host} ]
- then
- pid=`cat ~/.uml/${host}/pid`
- up=`ps up $pid | wc -l`
- fi
-
- if [ $up -eq 2 ]
- then
- cecho " * Great, ${host} is already running!"
- else
- rm -rf ~/.uml/${host}
- BOOTING_HOSTS="$BOOTING_HOSTS ${host}"
- let "count_max += 12"
-
- UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host}
- [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found"
-
- cecho-n " * Starting ${host}.."
- eval gnome-terminal --title=${host} --geometry="+${x0}+${y0}" --show-menubar --execute "$UMLKERNEL \
- umid=${host} \
- ubda=$UMLHOSTFS \
- \$SWITCH_${host} \
- mem=${MEM}M con=pty con0=fd:0,fd:1" &
- cgecho "done"
- sleep 15
- fi
- let "x0+=dx"
- let "y0+=dy"
-done
-
-if [ -z "$BOOTING_HOSTS" ]
-then
- exit 0
-fi
-
-cecho " * Waiting for the uml instances to finish booting"
-
-for host in $BOOTING_HOSTS
-do
- cecho-n " * Checking on $host.."
-
- while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ]
- do
- cecho-n "."
- sleep 5
- let "count+=1"
- done
-
- if [ $count -ge $count_max ]
- then
- cecho "exit"
- exit 1
- fi
-
- up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l`
-
- while [ $count -lt $count_max ] && [ $up -eq 0 ]
- do
- cecho-n "."
- sleep 5
- up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l`
- let "count+=1"
- done
-
- if [ $count -ge $count_max ]
- then
- cecho "exit"
- exit 1
- else
- cgecho "up"
- fi
-
- if [ "$host" = "alice" ]
- then
- sleep 5
- eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
- ssh root@$ipv4_alice /etc/init.d/net.eth1 stop
- fi
-done
-
-cecho " * All uml instances are up now"
diff --git a/testing/scripts/install-shared b/testing/scripts/install-shared
deleted file mode 100755
index 4cfac9e77..000000000
--- a/testing/scripts/install-shared
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/bash
-# Install strongSwan from mounted strongswan-shared tree
-#
-# Copyright (C) 2006 Martin Willi
-# Hochschule fuer Technik Rapperswil
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-#
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-cecho "installing strongSwan from shared tree"
-cecho-n " on: "
-
-for host in $STRONGSWANHOSTS
-do
- eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
- cecho-n "$host... "
- ssh $HOSTLOGIN 'cd ~/strongswan-shared && make install' > /dev/null
-done
-
-cecho
diff --git a/testing/scripts/kstart-umls b/testing/scripts/kstart-umls
deleted file mode 100755
index 18dc64a9d..000000000
--- a/testing/scripts/kstart-umls
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/bin/bash
-# starts the UML instances in a konsole (requires KDE)
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-if [ "$#" -eq 0 ]
-then
- HOSTS=$STRONGSWANHOSTS
-else
- HOSTS=$*
-fi
-
-BOOTING_HOSTS=""
-count_max=12
-count=0
-
-#position of konsole window on the desktop
-x0=8
-y0=8
-dx=12
-dy=24
-
-for host in $HOSTS
-do
- up=0
-
- if [ -d ~/.uml/${host} ]
- then
- pid=`cat ~/.uml/${host}/pid`
- up=`ps up $pid | wc -l`
- fi
-
- if [ $up -eq 2 ]
- then
- cecho " * Great, ${host} is already running!"
- else
- rm -rf ~/.uml/${host}
- BOOTING_HOSTS="$BOOTING_HOSTS ${host}"
- let "count_max += 12"
-
- UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host}
- [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found"
-
- cecho-n " * Starting ${host}.."
- eval konsole -title ${host} --geometry "+${x0}+${y0}" -e "$UMLKERNEL \
- umid=${host} \
- ubda=$UMLHOSTFS \
- \$SWITCH_${host} \
- mem=${MEM}M con=pty con0=fd:0,fd:1" &
- cgecho "done"
- sleep 15
- fi
- let "x0+=dx"
- let "y0+=dy"
-done
-
-if [ -z "$BOOTING_HOSTS" ]
-then
- exit 0
-fi
-
-cecho " * Waiting for the uml instances to finish booting"
-
-for host in $BOOTING_HOSTS
-do
- cecho-n " * Checking on $host.."
-
- while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ]
- do
- cecho-n "."
- sleep 5
- let "count+=1"
- done
-
- if [ $count -ge $count_max ]
- then
- cecho "exit"
- exit 1
- fi
-
- up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l`
-
- while [ $count -lt $count_max ] && [ $up -eq 0 ]
- do
- cecho-n "."
- sleep 5
- up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l`
- let "count+=1"
- done
-
- if [ $count -ge $count_max ]
- then
- cecho "exit"
- exit 1
- else
- cgecho "up"
- fi
-
- if [ "$host" = "alice" ]
- then
- sleep 5
- eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
- ssh root@$ipv4_alice /etc/init.d/net.eth1 stop
- fi
-done
-
-cecho " * All uml instances are up now"
diff --git a/testing/scripts/load-testconfig b/testing/scripts/load-testconfig
index 43100dbe0..0ea4fbf00 100755
--- a/testing/scripts/load-testconfig
+++ b/testing/scripts/load-testconfig
@@ -14,13 +14,9 @@
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
+DIR=$(dirname `readlink -f $0`)
+. $DIR/../testing.conf
+. $DIR/function.sh
##########################################################################
# load-testconfig requires a testname as an argument
@@ -58,17 +54,16 @@ for host in $IPSECHOSTS
do
eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/auth.log /var/log/daemon.log; \
- kill -SIGHUP `cat /var/run/syslogd.pid`' > /dev/null 2>&1
+ kill -SIGHUP `cat /var/run/rsyslogd.pid`' > /dev/null 2>&1
done
##########################################################################
-# clear radius.log and daemon.log on FreeRadius servers
+# clear radius.log on FreeRadius servers
#
for host in $RADIUSHOSTS
do
eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
- ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/radius/radius.log /var/log/daemon.log; \
- kill -SIGHUP `cat /var/run/syslogd.pid`' > /dev/null 2>&1
+ ssh $SSHCONF $HOSTLOGIN 'rm -f /var/log/freeradius/radius.log' > /dev/null 2>&1
done
diff --git a/testing/scripts/recipes/001_libtnc.mk b/testing/scripts/recipes/001_libtnc.mk
new file mode 100644
index 000000000..b835958b7
--- /dev/null
+++ b/testing/scripts/recipes/001_libtnc.mk
@@ -0,0 +1,31 @@
+#!/usr/bin/make
+
+PV = 1.25
+PKG = libtnc-$(PV)
+TAR = $(PKG).tar.gz
+SRC = http://downloads.sourceforge.net/project/libtnc/libtnc/$(PV)/$(TAR)
+
+NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
+
+CONFIG_OPTS = \
+ --sysconfdir=/etc
+
+all: install
+
+$(TAR):
+ wget $(SRC)
+
+.$(PKG)-unpacked: $(TAR)
+ tar xfz $(TAR)
+ @touch $@
+
+.$(PKG)-configured: .$(PKG)-unpacked
+ cd $(PKG) && ./configure $(CONFIG_OPTS)
+ @touch $@
+
+.$(PKG)-built: .$(PKG)-configured
+ cd $(PKG) && make -j $(NUM_CPUS)
+ @touch $@
+
+install: .$(PKG)-built
+ cd $(PKG) && make install
diff --git a/testing/scripts/recipes/002_tnc-fhh.mk b/testing/scripts/recipes/002_tnc-fhh.mk
new file mode 100644
index 000000000..397cef950
--- /dev/null
+++ b/testing/scripts/recipes/002_tnc-fhh.mk
@@ -0,0 +1,28 @@
+#!/usr/bin/make
+
+PKG = fhhtnc
+SRC = git://github.com/trustatfhh/tnc-fhh.git
+
+NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
+
+CONFIG_OPTS = \
+ -DCOMPONENT=all \
+ -DNAL=8021x
+
+all: install
+
+.$(PKG)-cloned:
+ git clone $(SRC) $(PKG)
+ mkdir $(PKG)/build
+ @touch $@
+
+.$(PKG)-configured: .$(PKG)-cloned
+ cd $(PKG)/build && cmake $(CONFIG_OPTS) ../
+ @touch $@
+
+.$(PKG)-built: .$(PKG)-configured
+ cd $(PKG)/build && make -j $(NUM_CPUS)
+ @touch $@
+
+install: .$(PKG)-built
+ cd $(PKG)/build && make install
diff --git a/testing/scripts/recipes/003_freeradius.mk b/testing/scripts/recipes/003_freeradius.mk
new file mode 100644
index 000000000..7b7a5fe82
--- /dev/null
+++ b/testing/scripts/recipes/003_freeradius.mk
@@ -0,0 +1,44 @@
+#!/usr/bin/make
+
+PV = 2.2.0
+PKG = freeradius-server-$(PV)
+TAR = $(PKG).tar.bz2
+SRC = ftp://ftp.freeradius.org/pub/freeradius/$(TAR)
+
+NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
+
+CONFIG_OPTS = \
+ --with-raddbdir=/etc/freeradius \
+ --sysconfdir=/etc \
+ --with-logdir=/var/log/freeradius \
+ --enable-developer \
+ --with-experimental-modules
+
+PATCHES = \
+ freeradius-eap-sim-identity \
+ freeradius-avp-size \
+ freeradius-tnc-fhh
+
+all: install
+
+$(TAR):
+ wget $(SRC)
+
+.$(PKG)-unpacked: $(TAR)
+ tar xfj $(TAR)
+ @touch $@
+
+.$(PKG)-patches-applied: .$(PKG)-unpacked
+ cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
+ @touch $@
+
+.$(PKG)-configured: .$(PKG)-patches-applied
+ cd $(PKG) && ./configure $(CONFIG_OPTS)
+ @touch $@
+
+.$(PKG)-built: .$(PKG)-configured
+ cd $(PKG) && make -j $(NUM_CPUS)
+ @touch $@
+
+install: .$(PKG)-built
+ cd $(PKG) && make install
diff --git a/testing/scripts/recipes/004_iptables.mk b/testing/scripts/recipes/004_iptables.mk
new file mode 100644
index 000000000..51200201a
--- /dev/null
+++ b/testing/scripts/recipes/004_iptables.mk
@@ -0,0 +1,37 @@
+#!/usr/bin/make
+
+PV = 1.4.16.3
+PKG = iptables-$(PV)
+TAR = $(PKG).tar.bz2
+SRC = http://www.netfilter.org/projects/iptables/files/$(TAR)
+
+NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
+
+CONFIG_OPTS =
+
+PATCHES = \
+ iptables-xfrm-hooks
+
+all: install
+
+$(TAR):
+ wget $(SRC)
+
+.$(PKG)-unpacked: $(TAR)
+ tar xfj $(TAR)
+ @touch $@
+
+.$(PKG)-patches-applied: .$(PKG)-unpacked
+ cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
+ @touch $@
+
+.$(PKG)-configured: .$(PKG)-patches-applied
+ cd $(PKG) && ./configure $(CONFIG_OPTS)
+ @touch $@
+
+.$(PKG)-built: .$(PKG)-configured
+ cd $(PKG) && make -j $(NUM_CPUS)
+ @touch $@
+
+install: .$(PKG)-built
+ cd $(PKG) && make install
diff --git a/testing/scripts/recipes/005_strongswan.mk b/testing/scripts/recipes/005_strongswan.mk
new file mode 100644
index 000000000..76d2d0882
--- /dev/null
+++ b/testing/scripts/recipes/005_strongswan.mk
@@ -0,0 +1,87 @@
+#!/usr/bin/make
+
+PV = $(SWANVERSION)
+PKG = strongswan-$(PV)
+TAR = $(PKG).tar.bz2
+SRC = http://download.strongswan.org/$(TAR)
+
+NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
+
+CONFIG_OPTS = \
+ --sysconfdir=/etc \
+ --with-random-device=/dev/urandom \
+ --disable-load-warning \
+ --enable-curl \
+ --enable-ldap \
+ --enable-eap-aka \
+ --enable-eap-aka-3gpp2 \
+ --enable-eap-sim \
+ --enable-eap-sim-file \
+ --enable-eap-md5 \
+ --enable-md4 \
+ --enable-eap-mschapv2 \
+ --enable-eap-identity \
+ --enable-eap-radius \
+ --enable-eap-dynamic \
+ --enable-eap-tls \
+ --enable-eap-ttls \
+ --enable-eap-peap \
+ --enable-eap-tnc \
+ --enable-tnc-pdp \
+ --enable-tnc-imc \
+ --enable-tnc-imv \
+ --enable-tnccs-11 \
+ --enable-tnccs-20 \
+ --enable-tnccs-dynamic \
+ --enable-imc-test \
+ --enable-imv-test \
+ --enable-imc-scanner \
+ --enable-imv-scanner \
+ --enable-imc-os \
+ --enable-imv-os \
+ --enable-imc-attestation \
+ --enable-imv-attestation \
+ --enable-sql \
+ --enable-sqlite \
+ --enable-mediation \
+ --enable-openssl \
+ --enable-blowfish \
+ --enable-kernel-pfkey \
+ --enable-integrity-test \
+ --enable-leak-detective \
+ --enable-load-tester \
+ --enable-test-vectors \
+ --enable-gcrypt \
+ --enable-socket-default \
+ --enable-socket-dynamic \
+ --enable-dhcp \
+ --enable-farp \
+ --enable-addrblock \
+ --enable-ctr \
+ --enable-ccm \
+ --enable-gcm \
+ --enable-cmac \
+ --enable-ha \
+ --enable-af-alg \
+ --enable-whitelist \
+ --enable-xauth-generic \
+ --enable-xauth-eap \
+ --enable-pkcs8 \
+ --enable-unity
+
+all: install
+
+$(TAR):
+ wget $(SRC)
+
+$(PKG): $(TAR)
+ tar xfj $(TAR)
+
+configure: $(PKG)
+ cd $(PKG) && ./configure $(CONFIG_OPTS)
+
+build: configure
+ cd $(PKG) && make -j $(NUM_CPUS)
+
+install: build
+ cd $(PKG) && make install
diff --git a/testing/scripts/recipes/patches/freeradius-avp-size b/testing/scripts/recipes/patches/freeradius-avp-size
new file mode 100644
index 000000000..e7e1f635b
--- /dev/null
+++ b/testing/scripts/recipes/patches/freeradius-avp-size
@@ -0,0 +1,18 @@
+diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
+index 6c9bd13..3344c53 100644
+--- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
++++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
+@@ -201,8 +201,11 @@ static VALUE_PAIR *diameter2vp(REQUEST *request, SSL *ssl,
+ goto next_attr;
+ }
+
+- if (size > 253) {
+- RDEBUG2("WARNING: diameter2vp skipping long attribute %u, attr");
++ /*
++ * EAP-Message AVPs can be larger than 253 octets.
++ */
++ if ((size > 253) && !((VENDOR(attr) == 0) && (attr == PW_EAP_MESSAGE))) {
++ RDEBUG2("WARNING: diameter2vp skipping long attribute %u", attr);
+ goto next_attr;
+ }
+
diff --git a/testing/scripts/recipes/patches/freeradius-eap-sim-identity b/testing/scripts/recipes/patches/freeradius-eap-sim-identity
new file mode 100644
index 000000000..1ab95ecc6
--- /dev/null
+++ b/testing/scripts/recipes/patches/freeradius-eap-sim-identity
@@ -0,0 +1,30 @@
+--- a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:03:05.081225276 +0100
++++ b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:46:59.746289881 +0100
+@@ -246,14 +246,21 @@
+ newvp->vp_integer = ess->sim_id++;
+ pairreplace(outvps, newvp);
+
++ ess->keys.identitylen = strlen(handler->identity);
++ memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen);
++
+ /* make a copy of the identity */
+ newvp = pairfind(*invps, ATTRIBUTE_EAP_SIM_BASE + PW_EAP_SIM_IDENTITY);
+- if (newvp) {
+- ess->keys.identitylen = newvp->length;
+- memcpy(ess->keys.identity, newvp->vp_octets, newvp->length);
+- } else {
+- ess->keys.identitylen = strlen(handler->identity);
+- memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen);
++ if (newvp && newvp->length > 2) {
++ uint16_t len;
++
++ memcpy(&len, newvp->vp_octets, sizeof(uint16_t));
++ len = ntohs(len);
++ if (len <= newvp->length - 2 && len <= MAX_STRING_LEN) {
++ ess->keys.identitylen = len;
++ memcpy(ess->keys.identity, newvp->vp_octets + 2,
++ ess->keys.identitylen);
++ }
+ }
+
+ /* all set, calculate keys! */
diff --git a/testing/scripts/recipes/patches/freeradius-tnc-fhh b/testing/scripts/recipes/patches/freeradius-tnc-fhh
new file mode 100644
index 000000000..5abc6b25f
--- /dev/null
+++ b/testing/scripts/recipes/patches/freeradius-tnc-fhh
@@ -0,0 +1,6687 @@
+diff -u -r -N freeradius-server-2.2.0.orig/share/dictionary freeradius-server-2.2.0/share/dictionary
+--- freeradius-server-2.2.0.orig/share/dictionary 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/share/dictionary 2012-12-04 19:39:42.261423097 +0100
+@@ -196,6 +196,7 @@
+ $INCLUDE dictionary.starent
+ $INCLUDE dictionary.symbol
+ $INCLUDE dictionary.telebit
++$INCLUDE dictionary.tncfhh
+ $INCLUDE dictionary.terena
+ $INCLUDE dictionary.trapeze
+ $INCLUDE dictionary.tropos
+diff -u -r -N freeradius-server-2.2.0.orig/share/dictionary.tncfhh freeradius-server-2.2.0/share/dictionary.tncfhh
+--- freeradius-server-2.2.0.orig/share/dictionary.tncfhh 1970-01-01 01:00:00.000000000 +0100
++++ freeradius-server-2.2.0/share/dictionary.tncfhh 2012-12-04 19:39:49.645421869 +0100
+@@ -0,0 +1,20 @@
++# -*- text -*-
++# Dictionary for the tnc@fhh Server.
++#
++# Website: http://trust.inform.fh-hannover.de
++#
++# Version: 0.8.4
++# Author: Bastian Hellmann
++# Email: trust@f4-i.fh-hannover.de
++#
++
++VENDOR tncfhh 10000
++BEGIN-VENDOR tncfhh
++
++ATTRIBUTE TNC-Status 1 integer
++
++VALUE TNC-Status Access 0
++VALUE TNC-Status Isolate 1
++VALUE TNC-Status None 2
++
++END-VENDOR tncfhh
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure 2012-12-04 19:38:00.237420970 +0100
+@@ -1,61 +1,84 @@
+ #! /bin/sh
+ # From configure.in Revision.
+ # Guess values for system-dependent variables and create Makefiles.
+-# Generated by GNU Autoconf 2.61.
++# Generated by GNU Autoconf 2.67.
++#
+ #
+ # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
+-# 2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc.
++# 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Free Software
++# Foundation, Inc.
++#
++#
+ # This configure script is free software; the Free Software Foundation
+ # gives unlimited permission to copy, distribute and modify it.
+-## --------------------- ##
+-## M4sh Initialization. ##
+-## --------------------- ##
++## -------------------- ##
++## M4sh Initialization. ##
++## -------------------- ##
+
+ # Be more Bourne compatible
+ DUALCASE=1; export DUALCASE # for MKS sh
+-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
++if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+ emulate sh
+ NULLCMD=:
+- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
++ # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
+ # is contrary to our usage. Disable this feature.
+ alias -g '${1+"$@"}'='"$@"'
+ setopt NO_GLOB_SUBST
+ else
+- case `(set -o) 2>/dev/null` in
+- *posix*) set -o posix ;;
++ case `(set -o) 2>/dev/null` in #(
++ *posix*) :
++ set -o posix ;; #(
++ *) :
++ ;;
+ esac
+-
+ fi
+
+
+-
+-
+-# PATH needs CR
+-# Avoid depending upon Character Ranges.
+-as_cr_letters='abcdefghijklmnopqrstuvwxyz'
+-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+-as_cr_Letters=$as_cr_letters$as_cr_LETTERS
+-as_cr_digits='0123456789'
+-as_cr_alnum=$as_cr_Letters$as_cr_digits
+-
+-# The user is always right.
+-if test "${PATH_SEPARATOR+set}" != set; then
+- echo "#! /bin/sh" >conf$$.sh
+- echo "exit 0" >>conf$$.sh
+- chmod +x conf$$.sh
+- if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then
+- PATH_SEPARATOR=';'
++as_nl='
++'
++export as_nl
++# Printing a long string crashes Solaris 7 /usr/bin/printf.
++as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
++# Prefer a ksh shell builtin over an external printf program on Solaris,
++# but without wasting forks for bash or zsh.
++if test -z "$BASH_VERSION$ZSH_VERSION" \
++ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
++ as_echo='print -r --'
++ as_echo_n='print -rn --'
++elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
++ as_echo='printf %s\n'
++ as_echo_n='printf %s'
++else
++ if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
++ as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
++ as_echo_n='/usr/ucb/echo -n'
+ else
+- PATH_SEPARATOR=:
++ as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
++ as_echo_n_body='eval
++ arg=$1;
++ case $arg in #(
++ *"$as_nl"*)
++ expr "X$arg" : "X\\(.*\\)$as_nl";
++ arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
++ esac;
++ expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
++ '
++ export as_echo_n_body
++ as_echo_n='sh -c $as_echo_n_body as_echo'
+ fi
+- rm -f conf$$.sh
++ export as_echo_body
++ as_echo='sh -c $as_echo_body as_echo'
+ fi
+
+-# Support unset when possible.
+-if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then
+- as_unset=unset
+-else
+- as_unset=false
++# The user is always right.
++if test "${PATH_SEPARATOR+set}" != set; then
++ PATH_SEPARATOR=:
++ (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
++ (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
++ PATH_SEPARATOR=';'
++ }
+ fi
+
+
+@@ -64,20 +87,18 @@
+ # there to prevent editors from complaining about space-tab.
+ # (If _AS_PATH_WALK were called with IFS unset, it would disable word
+ # splitting by setting IFS to empty value.)
+-as_nl='
+-'
+ IFS=" "" $as_nl"
+
+ # Find who we are. Look in the path if we contain no directory separator.
+-case $0 in
++case $0 in #((
+ *[\\/]* ) as_myself=$0 ;;
+ *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+ for as_dir in $PATH
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+-done
++ test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
++ done
+ IFS=$as_save_IFS
+
+ ;;
+@@ -88,354 +109,321 @@
+ as_myself=$0
+ fi
+ if test ! -f "$as_myself"; then
+- echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+- { (exit 1); exit 1; }
++ $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
++ exit 1
+ fi
+
+-# Work around bugs in pre-3.0 UWIN ksh.
+-for as_var in ENV MAIL MAILPATH
+-do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
++# Unset variables that we do not need and which cause bugs (e.g. in
++# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1"
++# suppresses any "Segmentation fault" message there. '((' could
++# trigger a bug in pdksh 5.2.14.
++for as_var in BASH_ENV ENV MAIL MAILPATH
++do eval test x\${$as_var+set} = xset \
++ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+ done
+ PS1='$ '
+ PS2='> '
+ PS4='+ '
+
+ # NLS nuisances.
+-for as_var in \
+- LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \
+- LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \
+- LC_TELEPHONE LC_TIME
+-do
+- if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then
+- eval $as_var=C; export $as_var
+- else
+- ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
+- fi
+-done
+-
+-# Required to use basename.
+-if expr a : '\(a\)' >/dev/null 2>&1 &&
+- test "X`expr 00001 : '.*\(...\)'`" = X001; then
+- as_expr=expr
+-else
+- as_expr=false
+-fi
+-
+-if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
+- as_basename=basename
+-else
+- as_basename=false
+-fi
+-
+-
+-# Name of the executable.
+-as_me=`$as_basename -- "$0" ||
+-$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
+- X"$0" : 'X\(//\)$' \| \
+- X"$0" : 'X\(/\)' \| . 2>/dev/null ||
+-echo X/"$0" |
+- sed '/^.*\/\([^/][^/]*\)\/*$/{
+- s//\1/
+- q
+- }
+- /^X\/\(\/\/\)$/{
+- s//\1/
+- q
+- }
+- /^X\/\(\/\).*/{
+- s//\1/
+- q
+- }
+- s/.*/./; q'`
++LC_ALL=C
++export LC_ALL
++LANGUAGE=C
++export LANGUAGE
+
+ # CDPATH.
+-$as_unset CDPATH
+-
++(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
+
+ if test "x$CONFIG_SHELL" = x; then
+- if (eval ":") 2>/dev/null; then
+- as_have_required=yes
++ as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then :
++ emulate sh
++ NULLCMD=:
++ # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which
++ # is contrary to our usage. Disable this feature.
++ alias -g '\${1+\"\$@\"}'='\"\$@\"'
++ setopt NO_GLOB_SUBST
+ else
+- as_have_required=no
++ case \`(set -o) 2>/dev/null\` in #(
++ *posix*) :
++ set -o posix ;; #(
++ *) :
++ ;;
++esac
+ fi
+-
+- if test $as_have_required = yes && (eval ":
+-(as_func_return () {
+- (exit \$1)
+-}
+-as_func_success () {
+- as_func_return 0
+-}
+-as_func_failure () {
+- as_func_return 1
+-}
+-as_func_ret_success () {
+- return 0
+-}
+-as_func_ret_failure () {
+- return 1
+-}
++"
++ as_required="as_fn_return () { (exit \$1); }
++as_fn_success () { as_fn_return 0; }
++as_fn_failure () { as_fn_return 1; }
++as_fn_ret_success () { return 0; }
++as_fn_ret_failure () { return 1; }
+
+ exitcode=0
+-if as_func_success; then
+- :
+-else
+- exitcode=1
+- echo as_func_success failed.
+-fi
+-
+-if as_func_failure; then
+- exitcode=1
+- echo as_func_failure succeeded.
+-fi
+-
+-if as_func_ret_success; then
+- :
+-else
+- exitcode=1
+- echo as_func_ret_success failed.
+-fi
+-
+-if as_func_ret_failure; then
+- exitcode=1
+- echo as_func_ret_failure succeeded.
+-fi
+-
+-if ( set x; as_func_ret_success y && test x = \"\$1\" ); then
+- :
++as_fn_success || { exitcode=1; echo as_fn_success failed.; }
++as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; }
++as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; }
++as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; }
++if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then :
++
++else
++ exitcode=1; echo positional parameters were not saved.
++fi
++test x\$exitcode = x0 || exit 1"
++ as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO
++ as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO
++ eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" &&
++ test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1
++test \$(( 1 + 1 )) = 2 || exit 1"
++ if (eval "$as_required") 2>/dev/null; then :
++ as_have_required=yes
+ else
+- exitcode=1
+- echo positional parameters were not saved.
++ as_have_required=no
+ fi
++ if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then :
+
+-test \$exitcode = 0) || { (exit 1); exit 1; }
+-
+-(
+- as_lineno_1=\$LINENO
+- as_lineno_2=\$LINENO
+- test \"x\$as_lineno_1\" != \"x\$as_lineno_2\" &&
+- test \"x\`expr \$as_lineno_1 + 1\`\" = \"x\$as_lineno_2\") || { (exit 1); exit 1; }
+-") 2> /dev/null; then
+- :
+ else
+- as_candidate_shells=
+- as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
++as_found=false
+ for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- case $as_dir in
++ as_found=:
++ case $as_dir in #(
+ /*)
+ for as_base in sh bash ksh sh5; do
+- as_candidate_shells="$as_candidate_shells $as_dir/$as_base"
++ # Try only shells that exist, to save several forks.
++ as_shell=$as_dir/$as_base
++ if { test -f "$as_shell" || test -f "$as_shell.exe"; } &&
++ { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then :
++ CONFIG_SHELL=$as_shell as_have_required=yes
++ if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then :
++ break 2
++fi
++fi
+ done;;
+ esac
++ as_found=false
+ done
++$as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } &&
++ { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then :
++ CONFIG_SHELL=$SHELL as_have_required=yes
++fi; }
+ IFS=$as_save_IFS
+
+
+- for as_shell in $as_candidate_shells $SHELL; do
+- # Try only shells that exist, to save several forks.
+- if { test -f "$as_shell" || test -f "$as_shell.exe"; } &&
+- { ("$as_shell") 2> /dev/null <<\_ASEOF
+-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
+- emulate sh
+- NULLCMD=:
+- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
+- # is contrary to our usage. Disable this feature.
+- alias -g '${1+"$@"}'='"$@"'
+- setopt NO_GLOB_SUBST
+-else
+- case `(set -o) 2>/dev/null` in
+- *posix*) set -o posix ;;
+-esac
+-
++ if test "x$CONFIG_SHELL" != x; then :
++ # We cannot yet assume a decent shell, so we have to provide a
++ # neutralization value for shells without unset; and this also
++ # works around shells that cannot unset nonexistent variables.
++ BASH_ENV=/dev/null
++ ENV=/dev/null
++ (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV
++ export CONFIG_SHELL
++ exec "$CONFIG_SHELL" "$as_myself" ${1+"$@"}
++fi
++
++ if test x$as_have_required = xno; then :
++ $as_echo "$0: This script requires a shell more modern than all"
++ $as_echo "$0: the shells that I found on your system."
++ if test x${ZSH_VERSION+set} = xset ; then
++ $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should"
++ $as_echo "$0: be upgraded to zsh 4.3.4 or later."
++ else
++ $as_echo "$0: Please tell bug-autoconf@gnu.org about your system,
++$0: including any error possibly output before this
++$0: message. Then install a modern shell, or manually run
++$0: the script under such a shell if you do have one."
++ fi
++ exit 1
+ fi
+-
+-
+-:
+-_ASEOF
+-}; then
+- CONFIG_SHELL=$as_shell
+- as_have_required=yes
+- if { "$as_shell" 2> /dev/null <<\_ASEOF
+-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
+- emulate sh
+- NULLCMD=:
+- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
+- # is contrary to our usage. Disable this feature.
+- alias -g '${1+"$@"}'='"$@"'
+- setopt NO_GLOB_SUBST
+-else
+- case `(set -o) 2>/dev/null` in
+- *posix*) set -o posix ;;
+-esac
+-
+ fi
++fi
++SHELL=${CONFIG_SHELL-/bin/sh}
++export SHELL
++# Unset more variables known to interfere with behavior of common tools.
++CLICOLOR_FORCE= GREP_OPTIONS=
++unset CLICOLOR_FORCE GREP_OPTIONS
+
+-
+-:
+-(as_func_return () {
+- (exit $1)
+-}
+-as_func_success () {
+- as_func_return 0
+-}
+-as_func_failure () {
+- as_func_return 1
+-}
+-as_func_ret_success () {
+- return 0
+-}
+-as_func_ret_failure () {
+- return 1
++## --------------------- ##
++## M4sh Shell Functions. ##
++## --------------------- ##
++# as_fn_unset VAR
++# ---------------
++# Portably unset VAR.
++as_fn_unset ()
++{
++ { eval $1=; unset $1;}
+ }
++as_unset=as_fn_unset
+
+-exitcode=0
+-if as_func_success; then
+- :
+-else
+- exitcode=1
+- echo as_func_success failed.
+-fi
++# as_fn_set_status STATUS
++# -----------------------
++# Set $? to STATUS, without forking.
++as_fn_set_status ()
++{
++ return $1
++} # as_fn_set_status
+
+-if as_func_failure; then
+- exitcode=1
+- echo as_func_failure succeeded.
+-fi
++# as_fn_exit STATUS
++# -----------------
++# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
++as_fn_exit ()
++{
++ set +e
++ as_fn_set_status $1
++ exit $1
++} # as_fn_exit
++
++# as_fn_mkdir_p
++# -------------
++# Create "$as_dir" as a directory, including parents if necessary.
++as_fn_mkdir_p ()
++{
+
+-if as_func_ret_success; then
+- :
+-else
+- exitcode=1
+- echo as_func_ret_success failed.
+-fi
++ case $as_dir in #(
++ -*) as_dir=./$as_dir;;
++ esac
++ test -d "$as_dir" || eval $as_mkdir_p || {
++ as_dirs=
++ while :; do
++ case $as_dir in #(
++ *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
++ *) as_qdir=$as_dir;;
++ esac
++ as_dirs="'$as_qdir' $as_dirs"
++ as_dir=`$as_dirname -- "$as_dir" ||
++$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
++ X"$as_dir" : 'X\(//\)[^/]' \| \
++ X"$as_dir" : 'X\(//\)$' \| \
++ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
++$as_echo X"$as_dir" |
++ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
++ s//\1/
++ q
++ }
++ /^X\(\/\/\)[^/].*/{
++ s//\1/
++ q
++ }
++ /^X\(\/\/\)$/{
++ s//\1/
++ q
++ }
++ /^X\(\/\).*/{
++ s//\1/
++ q
++ }
++ s/.*/./; q'`
++ test -d "$as_dir" && break
++ done
++ test -z "$as_dirs" || eval "mkdir $as_dirs"
++ } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir"
+
+-if as_func_ret_failure; then
+- exitcode=1
+- echo as_func_ret_failure succeeded.
+-fi
+
+-if ( set x; as_func_ret_success y && test x = "$1" ); then
+- :
++} # as_fn_mkdir_p
++# as_fn_append VAR VALUE
++# ----------------------
++# Append the text in VALUE to the end of the definition contained in VAR. Take
++# advantage of any shell optimizations that allow amortized linear growth over
++# repeated appends, instead of the typical quadratic growth present in naive
++# implementations.
++if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
++ eval 'as_fn_append ()
++ {
++ eval $1+=\$2
++ }'
+ else
+- exitcode=1
+- echo positional parameters were not saved.
+-fi
+-
+-test $exitcode = 0) || { (exit 1); exit 1; }
+-
+-(
+- as_lineno_1=$LINENO
+- as_lineno_2=$LINENO
+- test "x$as_lineno_1" != "x$as_lineno_2" &&
+- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2") || { (exit 1); exit 1; }
+-
+-_ASEOF
+-}; then
+- break
+-fi
+-
+-fi
+-
+- done
+-
+- if test "x$CONFIG_SHELL" != x; then
+- for as_var in BASH_ENV ENV
+- do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
+- done
+- export CONFIG_SHELL
+- exec "$CONFIG_SHELL" "$as_myself" ${1+"$@"}
+-fi
+-
+-
+- if test $as_have_required = no; then
+- echo This script requires a shell more modern than all the
+- echo shells that I found on your system. Please install a
+- echo modern shell, or manually run the script under such a
+- echo shell if you do have one.
+- { (exit 1); exit 1; }
+-fi
+-
+-
+-fi
+-
+-fi
+-
++ as_fn_append ()
++ {
++ eval $1=\$$1\$2
++ }
++fi # as_fn_append
++
++# as_fn_arith ARG...
++# ------------------
++# Perform arithmetic evaluation on the ARGs, and store the result in the
++# global $as_val. Take advantage of shells that can avoid forks. The arguments
++# must be portable across $(()) and expr.
++if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
++ eval 'as_fn_arith ()
++ {
++ as_val=$(( $* ))
++ }'
++else
++ as_fn_arith ()
++ {
++ as_val=`expr "$@" || test $? -eq 1`
++ }
++fi # as_fn_arith
+
+
+-(eval "as_func_return () {
+- (exit \$1)
+-}
+-as_func_success () {
+- as_func_return 0
+-}
+-as_func_failure () {
+- as_func_return 1
+-}
+-as_func_ret_success () {
+- return 0
+-}
+-as_func_ret_failure () {
+- return 1
+-}
++# as_fn_error STATUS ERROR [LINENO LOG_FD]
++# ----------------------------------------
++# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
++# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
++# script with STATUS, using 1 if that was 0.
++as_fn_error ()
++{
++ as_status=$1; test $as_status -eq 0 && as_status=1
++ if test "$4"; then
++ as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
++ $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
++ fi
++ $as_echo "$as_me: error: $2" >&2
++ as_fn_exit $as_status
++} # as_fn_error
+
+-exitcode=0
+-if as_func_success; then
+- :
++if expr a : '\(a\)' >/dev/null 2>&1 &&
++ test "X`expr 00001 : '.*\(...\)'`" = X001; then
++ as_expr=expr
+ else
+- exitcode=1
+- echo as_func_success failed.
+-fi
+-
+-if as_func_failure; then
+- exitcode=1
+- echo as_func_failure succeeded.
++ as_expr=false
+ fi
+
+-if as_func_ret_success; then
+- :
++if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
++ as_basename=basename
+ else
+- exitcode=1
+- echo as_func_ret_success failed.
+-fi
+-
+-if as_func_ret_failure; then
+- exitcode=1
+- echo as_func_ret_failure succeeded.
++ as_basename=false
+ fi
+
+-if ( set x; as_func_ret_success y && test x = \"\$1\" ); then
+- :
++if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
++ as_dirname=dirname
+ else
+- exitcode=1
+- echo positional parameters were not saved.
++ as_dirname=false
+ fi
+
+-test \$exitcode = 0") || {
+- echo No shell found that supports shell functions.
+- echo Please tell autoconf@gnu.org about your system,
+- echo including any error possibly output before this
+- echo message
+-}
++as_me=`$as_basename -- "$0" ||
++$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
++ X"$0" : 'X\(//\)$' \| \
++ X"$0" : 'X\(/\)' \| . 2>/dev/null ||
++$as_echo X/"$0" |
++ sed '/^.*\/\([^/][^/]*\)\/*$/{
++ s//\1/
++ q
++ }
++ /^X\/\(\/\/\)$/{
++ s//\1/
++ q
++ }
++ /^X\/\(\/\).*/{
++ s//\1/
++ q
++ }
++ s/.*/./; q'`
+
++# Avoid depending upon Character Ranges.
++as_cr_letters='abcdefghijklmnopqrstuvwxyz'
++as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
++as_cr_Letters=$as_cr_letters$as_cr_LETTERS
++as_cr_digits='0123456789'
++as_cr_alnum=$as_cr_Letters$as_cr_digits
+
+
+- as_lineno_1=$LINENO
+- as_lineno_2=$LINENO
+- test "x$as_lineno_1" != "x$as_lineno_2" &&
+- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || {
+-
+- # Create $as_me.lineno as a copy of $as_myself, but with $LINENO
+- # uniformly replaced by the line number. The first 'sed' inserts a
+- # line-number line after each line using $LINENO; the second 'sed'
+- # does the real work. The second script uses 'N' to pair each
+- # line-number line with the line containing $LINENO, and appends
+- # trailing '-' during substitution so that $LINENO is not a special
+- # case at line end.
+- # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the
+- # scripts with optimization help from Paolo Bonzini. Blame Lee
+- # E. McMahon (1931-1989) for sed's syntax. :-)
++ as_lineno_1=$LINENO as_lineno_1a=$LINENO
++ as_lineno_2=$LINENO as_lineno_2a=$LINENO
++ eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" &&
++ test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || {
++ # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-)
+ sed -n '
+ p
+ /[$]LINENO/=
+@@ -452,8 +440,7 @@
+ s/-\n.*//
+ ' >$as_me.lineno &&
+ chmod +x "$as_me.lineno" ||
+- { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2
+- { (exit 1); exit 1; }; }
++ { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; }
+
+ # Don't try to exec as it changes $[0], causing all sort of problems
+ # (the dirname of $[0] is not the place where we might find the
+@@ -463,49 +450,40 @@
+ exit
+ }
+
+-
+-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
+- as_dirname=dirname
+-else
+- as_dirname=false
+-fi
+-
+ ECHO_C= ECHO_N= ECHO_T=
+-case `echo -n x` in
++case `echo -n x` in #(((((
+ -n*)
+- case `echo 'x\c'` in
++ case `echo 'xy\c'` in
+ *c*) ECHO_T=' ';; # ECHO_T is single tab character.
+- *) ECHO_C='\c';;
++ xy) ECHO_C='\c';;
++ *) echo `echo ksh88 bug on AIX 6.1` > /dev/null
++ ECHO_T=' ';;
+ esac;;
+ *)
+ ECHO_N='-n';;
+ esac
+
+-if expr a : '\(a\)' >/dev/null 2>&1 &&
+- test "X`expr 00001 : '.*\(...\)'`" = X001; then
+- as_expr=expr
+-else
+- as_expr=false
+-fi
+-
+ rm -f conf$$ conf$$.exe conf$$.file
+ if test -d conf$$.dir; then
+ rm -f conf$$.dir/conf$$.file
+ else
+ rm -f conf$$.dir
+- mkdir conf$$.dir
++ mkdir conf$$.dir 2>/dev/null
+ fi
+-echo >conf$$.file
+-if ln -s conf$$.file conf$$ 2>/dev/null; then
+- as_ln_s='ln -s'
+- # ... but there are two gotchas:
+- # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
+- # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
+- # In both cases, we have to default to `cp -p'.
+- ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
++if (echo >conf$$.file) 2>/dev/null; then
++ if ln -s conf$$.file conf$$ 2>/dev/null; then
++ as_ln_s='ln -s'
++ # ... but there are two gotchas:
++ # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
++ # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
++ # In both cases, we have to default to `cp -p'.
++ ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
++ as_ln_s='cp -p'
++ elif ln conf$$.file conf$$ 2>/dev/null; then
++ as_ln_s=ln
++ else
+ as_ln_s='cp -p'
+-elif ln conf$$.file conf$$ 2>/dev/null; then
+- as_ln_s=ln
++ fi
+ else
+ as_ln_s='cp -p'
+ fi
+@@ -513,7 +491,7 @@
+ rmdir conf$$.dir 2>/dev/null
+
+ if mkdir -p . 2>/dev/null; then
+- as_mkdir_p=:
++ as_mkdir_p='mkdir -p "$as_dir"'
+ else
+ test -d ./-p && rmdir ./-p
+ as_mkdir_p=false
+@@ -530,12 +508,12 @@
+ as_test_x='
+ eval sh -c '\''
+ if test -d "$1"; then
+- test -d "$1/.";
++ test -d "$1/.";
+ else
+- case $1 in
+- -*)set "./$1";;
++ case $1 in #(
++ -*)set "./$1";;
+ esac;
+- case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in
++ case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in #((
+ ???[sx]*):;;*)false;;esac;fi
+ '\'' sh
+ '
+@@ -549,11 +527,11 @@
+ as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'"
+
+
+-
+-exec 7<&0 </dev/null 6>&1
++test -n "$DJDIR" || exec 7<&0 </dev/null
++exec 6>&1
+
+ # Name of the host.
+-# hostname on some systems (SVR3.2, Linux) returns a bogus exit status,
++# hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status,
+ # so uname gets run too.
+ ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q`
+
+@@ -568,7 +546,6 @@
+ subdirs=
+ MFLAGS=
+ MAKEFLAGS=
+-SHELL=${CONFIG_SHELL-/bin/sh}
+
+ # Identity of this package.
+ PACKAGE_NAME=
+@@ -576,58 +553,102 @@
+ PACKAGE_VERSION=
+ PACKAGE_STRING=
+ PACKAGE_BUGREPORT=
++PACKAGE_URL=
+
+ ac_unique_file="rlm_eap_tnc.c"
+-ac_subst_vars='SHELL
+-PATH_SEPARATOR
+-PACKAGE_NAME
+-PACKAGE_TARNAME
+-PACKAGE_VERSION
+-PACKAGE_STRING
+-PACKAGE_BUGREPORT
+-exec_prefix
+-prefix
+-program_transform_name
+-bindir
+-sbindir
+-libexecdir
+-datarootdir
+-datadir
+-sysconfdir
+-sharedstatedir
+-localstatedir
+-includedir
+-oldincludedir
+-docdir
+-infodir
+-htmldir
+-dvidir
+-pdfdir
+-psdir
+-libdir
+-localedir
+-mandir
+-DEFS
+-ECHO_C
+-ECHO_N
+-ECHO_T
+-LIBS
+-build_alias
+-host_alias
+-target_alias
+-CC
+-CFLAGS
+-LDFLAGS
+-CPPFLAGS
+-ac_ct_CC
+-EXEEXT
+-OBJEXT
+-eap_tnc_cflags
+-eap_tnc_ldflags
+-targetname
++# Factoring default headers for most tests.
++ac_includes_default="\
++#include <stdio.h>
++#ifdef HAVE_SYS_TYPES_H
++# include <sys/types.h>
++#endif
++#ifdef HAVE_SYS_STAT_H
++# include <sys/stat.h>
++#endif
++#ifdef STDC_HEADERS
++# include <stdlib.h>
++# include <stddef.h>
++#else
++# ifdef HAVE_STDLIB_H
++# include <stdlib.h>
++# endif
++#endif
++#ifdef HAVE_STRING_H
++# if !defined STDC_HEADERS && defined HAVE_MEMORY_H
++# include <memory.h>
++# endif
++# include <string.h>
++#endif
++#ifdef HAVE_STRINGS_H
++# include <strings.h>
++#endif
++#ifdef HAVE_INTTYPES_H
++# include <inttypes.h>
++#endif
++#ifdef HAVE_STDINT_H
++# include <stdint.h>
++#endif
++#ifdef HAVE_UNISTD_H
++# include <unistd.h>
++#endif"
++
++ac_subst_vars='LTLIBOBJS
+ LIBOBJS
+-LTLIBOBJS'
++targetname
++eap_tnc_ldflags
++eap_tnc_cflags
++EGREP
++GREP
++CPP
++OBJEXT
++EXEEXT
++ac_ct_CC
++CPPFLAGS
++LDFLAGS
++CFLAGS
++CC
++target_alias
++host_alias
++build_alias
++LIBS
++ECHO_T
++ECHO_N
++ECHO_C
++DEFS
++mandir
++localedir
++libdir
++psdir
++pdfdir
++dvidir
++htmldir
++infodir
++docdir
++oldincludedir
++includedir
++localstatedir
++sharedstatedir
++sysconfdir
++datadir
++datarootdir
++libexecdir
++sbindir
++bindir
++program_transform_name
++prefix
++exec_prefix
++PACKAGE_URL
++PACKAGE_BUGREPORT
++PACKAGE_STRING
++PACKAGE_VERSION
++PACKAGE_TARNAME
++PACKAGE_NAME
++PATH_SEPARATOR
++SHELL'
+ ac_subst_files=''
++ac_user_opts='
++enable_option_checking
++'
+ ac_precious_vars='build_alias
+ host_alias
+ target_alias
+@@ -635,12 +656,15 @@
+ CFLAGS
+ LDFLAGS
+ LIBS
+-CPPFLAGS'
++CPPFLAGS
++CPP'
+
+
+ # Initialize some variables set by options.
+ ac_init_help=
+ ac_init_version=false
++ac_unrecognized_opts=
++ac_unrecognized_sep=
+ # The variables have the same names as the options, with
+ # dashes changed to underlines.
+ cache_file=/dev/null
+@@ -696,8 +720,9 @@
+ fi
+
+ case $ac_option in
+- *=*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;;
+- *) ac_optarg=yes ;;
++ *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;;
++ *=) ac_optarg= ;;
++ *) ac_optarg=yes ;;
+ esac
+
+ # Accept the important Cygnus configure options, so we can diagnose typos.
+@@ -739,13 +764,20 @@
+ datarootdir=$ac_optarg ;;
+
+ -disable-* | --disable-*)
+- ac_feature=`expr "x$ac_option" : 'x-*disable-\(.*\)'`
++ ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'`
+ # Reject names that are not valid shell variable names.
+- expr "x$ac_feature" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+- { echo "$as_me: error: invalid feature name: $ac_feature" >&2
+- { (exit 1); exit 1; }; }
+- ac_feature=`echo $ac_feature | sed 's/[-.]/_/g'`
+- eval enable_$ac_feature=no ;;
++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
++ as_fn_error $? "invalid feature name: $ac_useropt"
++ ac_useropt_orig=$ac_useropt
++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
++ case $ac_user_opts in
++ *"
++"enable_$ac_useropt"
++"*) ;;
++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig"
++ ac_unrecognized_sep=', ';;
++ esac
++ eval enable_$ac_useropt=no ;;
+
+ -docdir | --docdir | --docdi | --doc | --do)
+ ac_prev=docdir ;;
+@@ -758,13 +790,20 @@
+ dvidir=$ac_optarg ;;
+
+ -enable-* | --enable-*)
+- ac_feature=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'`
++ ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'`
+ # Reject names that are not valid shell variable names.
+- expr "x$ac_feature" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+- { echo "$as_me: error: invalid feature name: $ac_feature" >&2
+- { (exit 1); exit 1; }; }
+- ac_feature=`echo $ac_feature | sed 's/[-.]/_/g'`
+- eval enable_$ac_feature=\$ac_optarg ;;
++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
++ as_fn_error $? "invalid feature name: $ac_useropt"
++ ac_useropt_orig=$ac_useropt
++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
++ case $ac_user_opts in
++ *"
++"enable_$ac_useropt"
++"*) ;;
++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig"
++ ac_unrecognized_sep=', ';;
++ esac
++ eval enable_$ac_useropt=\$ac_optarg ;;
+
+ -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \
+ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \
+@@ -955,22 +994,36 @@
+ ac_init_version=: ;;
+
+ -with-* | --with-*)
+- ac_package=`expr "x$ac_option" : 'x-*with-\([^=]*\)'`
++ ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'`
+ # Reject names that are not valid shell variable names.
+- expr "x$ac_package" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+- { echo "$as_me: error: invalid package name: $ac_package" >&2
+- { (exit 1); exit 1; }; }
+- ac_package=`echo $ac_package | sed 's/[-.]/_/g'`
+- eval with_$ac_package=\$ac_optarg ;;
++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
++ as_fn_error $? "invalid package name: $ac_useropt"
++ ac_useropt_orig=$ac_useropt
++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
++ case $ac_user_opts in
++ *"
++"with_$ac_useropt"
++"*) ;;
++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig"
++ ac_unrecognized_sep=', ';;
++ esac
++ eval with_$ac_useropt=\$ac_optarg ;;
+
+ -without-* | --without-*)
+- ac_package=`expr "x$ac_option" : 'x-*without-\(.*\)'`
++ ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'`
+ # Reject names that are not valid shell variable names.
+- expr "x$ac_package" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+- { echo "$as_me: error: invalid package name: $ac_package" >&2
+- { (exit 1); exit 1; }; }
+- ac_package=`echo $ac_package | sed 's/[-.]/_/g'`
+- eval with_$ac_package=no ;;
++ expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
++ as_fn_error $? "invalid package name: $ac_useropt"
++ ac_useropt_orig=$ac_useropt
++ ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
++ case $ac_user_opts in
++ *"
++"with_$ac_useropt"
++"*) ;;
++ *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig"
++ ac_unrecognized_sep=', ';;
++ esac
++ eval with_$ac_useropt=no ;;
+
+ --x)
+ # Obsolete; use --with-x.
+@@ -990,25 +1043,25 @@
+ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*)
+ x_libraries=$ac_optarg ;;
+
+- -*) { echo "$as_me: error: unrecognized option: $ac_option
+-Try \`$0 --help' for more information." >&2
+- { (exit 1); exit 1; }; }
++ -*) as_fn_error $? "unrecognized option: \`$ac_option'
++Try \`$0 --help' for more information"
+ ;;
+
+ *=*)
+ ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='`
+ # Reject names that are not valid shell variable names.
+- expr "x$ac_envvar" : ".*[^_$as_cr_alnum]" >/dev/null &&
+- { echo "$as_me: error: invalid variable name: $ac_envvar" >&2
+- { (exit 1); exit 1; }; }
++ case $ac_envvar in #(
++ '' | [0-9]* | *[!_$as_cr_alnum]* )
++ as_fn_error $? "invalid variable name: \`$ac_envvar'" ;;
++ esac
+ eval $ac_envvar=\$ac_optarg
+ export $ac_envvar ;;
+
+ *)
+ # FIXME: should be removed in autoconf 3.0.
+- echo "$as_me: WARNING: you should use --build, --host, --target" >&2
++ $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2
+ expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+- echo "$as_me: WARNING: invalid host type: $ac_option" >&2
++ $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2
+ : ${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}
+ ;;
+
+@@ -1017,23 +1070,36 @@
+
+ if test -n "$ac_prev"; then
+ ac_option=--`echo $ac_prev | sed 's/_/-/g'`
+- { echo "$as_me: error: missing argument to $ac_option" >&2
+- { (exit 1); exit 1; }; }
++ as_fn_error $? "missing argument to $ac_option"
++fi
++
++if test -n "$ac_unrecognized_opts"; then
++ case $enable_option_checking in
++ no) ;;
++ fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;;
++ *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;;
++ esac
+ fi
+
+-# Be sure to have absolute directory names.
++# Check all directory arguments for consistency.
+ for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \
+ datadir sysconfdir sharedstatedir localstatedir includedir \
+ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
+ libdir localedir mandir
+ do
+ eval ac_val=\$$ac_var
++ # Remove trailing slashes.
++ case $ac_val in
++ */ )
++ ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'`
++ eval $ac_var=\$ac_val;;
++ esac
++ # Be sure to have absolute directory names.
+ case $ac_val in
+ [\\/$]* | ?:[\\/]* ) continue;;
+ NONE | '' ) case $ac_var in *prefix ) continue;; esac;;
+ esac
+- { echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2
+- { (exit 1); exit 1; }; }
++ as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val"
+ done
+
+ # There might be people who depend on the old broken behavior: `$host'
+@@ -1047,8 +1113,8 @@
+ if test "x$host_alias" != x; then
+ if test "x$build_alias" = x; then
+ cross_compiling=maybe
+- echo "$as_me: WARNING: If you wanted to set the --build type, don't use --host.
+- If a cross compiler is detected then cross compile mode will be used." >&2
++ $as_echo "$as_me: WARNING: if you wanted to set the --build type, don't use --host.
++ If a cross compiler is detected then cross compile mode will be used" >&2
+ elif test "x$build_alias" != "x$host_alias"; then
+ cross_compiling=yes
+ fi
+@@ -1063,23 +1129,21 @@
+ ac_pwd=`pwd` && test -n "$ac_pwd" &&
+ ac_ls_di=`ls -di .` &&
+ ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` ||
+- { echo "$as_me: error: Working directory cannot be determined" >&2
+- { (exit 1); exit 1; }; }
++ as_fn_error $? "working directory cannot be determined"
+ test "X$ac_ls_di" = "X$ac_pwd_ls_di" ||
+- { echo "$as_me: error: pwd does not report name of working directory" >&2
+- { (exit 1); exit 1; }; }
++ as_fn_error $? "pwd does not report name of working directory"
+
+
+ # Find the source files, if location was not specified.
+ if test -z "$srcdir"; then
+ ac_srcdir_defaulted=yes
+ # Try the directory containing this script, then the parent directory.
+- ac_confdir=`$as_dirname -- "$0" ||
+-$as_expr X"$0" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+- X"$0" : 'X\(//\)[^/]' \| \
+- X"$0" : 'X\(//\)$' \| \
+- X"$0" : 'X\(/\)' \| . 2>/dev/null ||
+-echo X"$0" |
++ ac_confdir=`$as_dirname -- "$as_myself" ||
++$as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
++ X"$as_myself" : 'X\(//\)[^/]' \| \
++ X"$as_myself" : 'X\(//\)$' \| \
++ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null ||
++$as_echo X"$as_myself" |
+ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+ s//\1/
+ q
+@@ -1106,13 +1170,11 @@
+ fi
+ if test ! -r "$srcdir/$ac_unique_file"; then
+ test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .."
+- { echo "$as_me: error: cannot find sources ($ac_unique_file) in $srcdir" >&2
+- { (exit 1); exit 1; }; }
++ as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir"
+ fi
+ ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work"
+ ac_abs_confdir=`(
+- cd "$srcdir" && test -r "./$ac_unique_file" || { echo "$as_me: error: $ac_msg" >&2
+- { (exit 1); exit 1; }; }
++ cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg"
+ pwd)`
+ # When building in place, set srcdir=.
+ if test "$ac_abs_confdir" = "$ac_pwd"; then
+@@ -1152,7 +1214,7 @@
+ --help=short display options specific to this package
+ --help=recursive display the short help of all the included packages
+ -V, --version display version information and exit
+- -q, --quiet, --silent do not print \`checking...' messages
++ -q, --quiet, --silent do not print \`checking ...' messages
+ --cache-file=FILE cache test results in FILE [disabled]
+ -C, --config-cache alias for \`--cache-file=config.cache'
+ -n, --no-create do not create output files
+@@ -1160,9 +1222,9 @@
+
+ Installation directories:
+ --prefix=PREFIX install architecture-independent files in PREFIX
+- [$ac_default_prefix]
++ [$ac_default_prefix]
+ --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX
+- [PREFIX]
++ [PREFIX]
+
+ By default, \`make install' will install all the files in
+ \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify
+@@ -1172,25 +1234,25 @@
+ For better control, use the options below.
+
+ Fine tuning of the installation directories:
+- --bindir=DIR user executables [EPREFIX/bin]
+- --sbindir=DIR system admin executables [EPREFIX/sbin]
+- --libexecdir=DIR program executables [EPREFIX/libexec]
+- --sysconfdir=DIR read-only single-machine data [PREFIX/etc]
+- --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
+- --localstatedir=DIR modifiable single-machine data [PREFIX/var]
+- --libdir=DIR object code libraries [EPREFIX/lib]
+- --includedir=DIR C header files [PREFIX/include]
+- --oldincludedir=DIR C header files for non-gcc [/usr/include]
+- --datarootdir=DIR read-only arch.-independent data root [PREFIX/share]
+- --datadir=DIR read-only architecture-independent data [DATAROOTDIR]
+- --infodir=DIR info documentation [DATAROOTDIR/info]
+- --localedir=DIR locale-dependent data [DATAROOTDIR/locale]
+- --mandir=DIR man documentation [DATAROOTDIR/man]
+- --docdir=DIR documentation root [DATAROOTDIR/doc/PACKAGE]
+- --htmldir=DIR html documentation [DOCDIR]
+- --dvidir=DIR dvi documentation [DOCDIR]
+- --pdfdir=DIR pdf documentation [DOCDIR]
+- --psdir=DIR ps documentation [DOCDIR]
++ --bindir=DIR user executables [EPREFIX/bin]
++ --sbindir=DIR system admin executables [EPREFIX/sbin]
++ --libexecdir=DIR program executables [EPREFIX/libexec]
++ --sysconfdir=DIR read-only single-machine data [PREFIX/etc]
++ --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com]
++ --localstatedir=DIR modifiable single-machine data [PREFIX/var]
++ --libdir=DIR object code libraries [EPREFIX/lib]
++ --includedir=DIR C header files [PREFIX/include]
++ --oldincludedir=DIR C header files for non-gcc [/usr/include]
++ --datarootdir=DIR read-only arch.-independent data root [PREFIX/share]
++ --datadir=DIR read-only architecture-independent data [DATAROOTDIR]
++ --infodir=DIR info documentation [DATAROOTDIR/info]
++ --localedir=DIR locale-dependent data [DATAROOTDIR/locale]
++ --mandir=DIR man documentation [DATAROOTDIR/man]
++ --docdir=DIR documentation root [DATAROOTDIR/doc/PACKAGE]
++ --htmldir=DIR html documentation [DOCDIR]
++ --dvidir=DIR dvi documentation [DOCDIR]
++ --pdfdir=DIR pdf documentation [DOCDIR]
++ --psdir=DIR ps documentation [DOCDIR]
+ _ACEOF
+
+ cat <<\_ACEOF
+@@ -1207,12 +1269,14 @@
+ LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a
+ nonstandard directory <lib dir>
+ LIBS libraries to pass to the linker, e.g. -l<library>
+- CPPFLAGS C/C++/Objective C preprocessor flags, e.g. -I<include dir> if
++ CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if
+ you have headers in a nonstandard directory <include dir>
++ CPP C preprocessor
+
+ Use these variables to override the choices made by `configure' or to help
+ it to find libraries and programs with nonstandard names/locations.
+
++Report bugs to the package provider.
+ _ACEOF
+ ac_status=$?
+ fi
+@@ -1220,15 +1284,17 @@
+ if test "$ac_init_help" = "recursive"; then
+ # If there are subdirs, report their specific --help.
+ for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue
+- test -d "$ac_dir" || continue
++ test -d "$ac_dir" ||
++ { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } ||
++ continue
+ ac_builddir=.
+
+ case "$ac_dir" in
+ .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
+ *)
+- ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'`
++ ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'`
+ # A ".." for each directory in $ac_dir_suffix.
+- ac_top_builddir_sub=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,/..,g;s,/,,'`
++ ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
+ case $ac_top_builddir_sub in
+ "") ac_top_builddir_sub=. ac_top_build_prefix= ;;
+ *) ac_top_build_prefix=$ac_top_builddir_sub/ ;;
+@@ -1264,7 +1330,7 @@
+ echo &&
+ $SHELL "$ac_srcdir/configure" --help=recursive
+ else
+- echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
++ $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
+ fi || ac_status=$?
+ cd "$ac_pwd" || { ac_status=$?; break; }
+ done
+@@ -1274,21 +1340,305 @@
+ if $ac_init_version; then
+ cat <<\_ACEOF
+ configure
+-generated by GNU Autoconf 2.61
++generated by GNU Autoconf 2.67
+
+-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
+-2002, 2003, 2004, 2005, 2006 Free Software Foundation, Inc.
++Copyright (C) 2010 Free Software Foundation, Inc.
+ This configure script is free software; the Free Software Foundation
+ gives unlimited permission to copy, distribute and modify it.
+ _ACEOF
+ exit
+ fi
++
++## ------------------------ ##
++## Autoconf initialization. ##
++## ------------------------ ##
++
++# ac_fn_c_try_compile LINENO
++# --------------------------
++# Try to compile conftest.$ac_ext, and return whether this succeeded.
++ac_fn_c_try_compile ()
++{
++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
++ rm -f conftest.$ac_objext
++ if { { ac_try="$ac_compile"
++case "(($ac_try" in
++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
++ *) ac_try_echo=$ac_try;;
++esac
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
++ (eval "$ac_compile") 2>conftest.err
++ ac_status=$?
++ if test -s conftest.err; then
++ grep -v '^ *+' conftest.err >conftest.er1
++ cat conftest.er1 >&5
++ mv -f conftest.er1 conftest.err
++ fi
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; } && {
++ test -z "$ac_c_werror_flag" ||
++ test ! -s conftest.err
++ } && test -s conftest.$ac_objext; then :
++ ac_retval=0
++else
++ $as_echo "$as_me: failed program was:" >&5
++sed 's/^/| /' conftest.$ac_ext >&5
++
++ ac_retval=1
++fi
++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;}
++ as_fn_set_status $ac_retval
++
++} # ac_fn_c_try_compile
++
++# ac_fn_c_try_link LINENO
++# -----------------------
++# Try to link conftest.$ac_ext, and return whether this succeeded.
++ac_fn_c_try_link ()
++{
++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
++ rm -f conftest.$ac_objext conftest$ac_exeext
++ if { { ac_try="$ac_link"
++case "(($ac_try" in
++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
++ *) ac_try_echo=$ac_try;;
++esac
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
++ (eval "$ac_link") 2>conftest.err
++ ac_status=$?
++ if test -s conftest.err; then
++ grep -v '^ *+' conftest.err >conftest.er1
++ cat conftest.er1 >&5
++ mv -f conftest.er1 conftest.err
++ fi
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; } && {
++ test -z "$ac_c_werror_flag" ||
++ test ! -s conftest.err
++ } && test -s conftest$ac_exeext && {
++ test "$cross_compiling" = yes ||
++ $as_test_x conftest$ac_exeext
++ }; then :
++ ac_retval=0
++else
++ $as_echo "$as_me: failed program was:" >&5
++sed 's/^/| /' conftest.$ac_ext >&5
++
++ ac_retval=1
++fi
++ # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
++ # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
++ # interfere with the next link command; also delete a directory that is
++ # left behind by Apple's compiler. We do this before executing the actions.
++ rm -rf conftest.dSYM conftest_ipa8_conftest.oo
++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;}
++ as_fn_set_status $ac_retval
++
++} # ac_fn_c_try_link
++
++# ac_fn_c_try_cpp LINENO
++# ----------------------
++# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
++ac_fn_c_try_cpp ()
++{
++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
++ if { { ac_try="$ac_cpp conftest.$ac_ext"
++case "(($ac_try" in
++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
++ *) ac_try_echo=$ac_try;;
++esac
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
++ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
++ ac_status=$?
++ if test -s conftest.err; then
++ grep -v '^ *+' conftest.err >conftest.er1
++ cat conftest.er1 >&5
++ mv -f conftest.er1 conftest.err
++ fi
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; } > conftest.i && {
++ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
++ test ! -s conftest.err
++ }; then :
++ ac_retval=0
++else
++ $as_echo "$as_me: failed program was:" >&5
++sed 's/^/| /' conftest.$ac_ext >&5
++
++ ac_retval=1
++fi
++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;}
++ as_fn_set_status $ac_retval
++
++} # ac_fn_c_try_cpp
++
++# ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES
++# -------------------------------------------------------
++# Tests whether HEADER exists, giving a warning if it cannot be compiled using
++# the include files in INCLUDES and setting the cache variable VAR
++# accordingly.
++ac_fn_c_check_header_mongrel ()
++{
++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
++ if eval "test \"\${$3+set}\"" = set; then :
++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
++$as_echo_n "checking for $2... " >&6; }
++if eval "test \"\${$3+set}\"" = set; then :
++ $as_echo_n "(cached) " >&6
++fi
++eval ac_res=\$$3
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
++$as_echo "$ac_res" >&6; }
++else
++ # Is the header compilable?
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5
++$as_echo_n "checking $2 usability... " >&6; }
++cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++$4
++#include <$2>
++_ACEOF
++if ac_fn_c_try_compile "$LINENO"; then :
++ ac_header_compiler=yes
++else
++ ac_header_compiler=no
++fi
++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5
++$as_echo "$ac_header_compiler" >&6; }
++
++# Is the header present?
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5
++$as_echo_n "checking $2 presence... " >&6; }
++cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#include <$2>
++_ACEOF
++if ac_fn_c_try_cpp "$LINENO"; then :
++ ac_header_preproc=yes
++else
++ ac_header_preproc=no
++fi
++rm -f conftest.err conftest.i conftest.$ac_ext
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5
++$as_echo "$ac_header_preproc" >&6; }
++
++# So? What about this header?
++case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #((
++ yes:no: )
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5
++$as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
++$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
++ ;;
++ no:yes:* )
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5
++$as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5
++$as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5
++$as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5
++$as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
++$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
++ ;;
++esac
++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
++$as_echo_n "checking for $2... " >&6; }
++if eval "test \"\${$3+set}\"" = set; then :
++ $as_echo_n "(cached) " >&6
++else
++ eval "$3=\$ac_header_compiler"
++fi
++eval ac_res=\$$3
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
++$as_echo "$ac_res" >&6; }
++fi
++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;}
++
++} # ac_fn_c_check_header_mongrel
++
++# ac_fn_c_try_run LINENO
++# ----------------------
++# Try to link conftest.$ac_ext, and return whether this succeeded. Assumes
++# that executables *can* be run.
++ac_fn_c_try_run ()
++{
++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
++ if { { ac_try="$ac_link"
++case "(($ac_try" in
++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
++ *) ac_try_echo=$ac_try;;
++esac
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
++ (eval "$ac_link") 2>&5
++ ac_status=$?
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; } && { ac_try='./conftest$ac_exeext'
++ { { case "(($ac_try" in
++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
++ *) ac_try_echo=$ac_try;;
++esac
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
++ (eval "$ac_try") 2>&5
++ ac_status=$?
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; }; }; then :
++ ac_retval=0
++else
++ $as_echo "$as_me: program exited with status $ac_status" >&5
++ $as_echo "$as_me: failed program was:" >&5
++sed 's/^/| /' conftest.$ac_ext >&5
++
++ ac_retval=$ac_status
++fi
++ rm -rf conftest.dSYM conftest_ipa8_conftest.oo
++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;}
++ as_fn_set_status $ac_retval
++
++} # ac_fn_c_try_run
++
++# ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES
++# -------------------------------------------------------
++# Tests whether HEADER exists and can be compiled using the include files in
++# INCLUDES, setting the cache variable VAR accordingly.
++ac_fn_c_check_header_compile ()
++{
++ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
++$as_echo_n "checking for $2... " >&6; }
++if eval "test \"\${$3+set}\"" = set; then :
++ $as_echo_n "(cached) " >&6
++else
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++$4
++#include <$2>
++_ACEOF
++if ac_fn_c_try_compile "$LINENO"; then :
++ eval "$3=yes"
++else
++ eval "$3=no"
++fi
++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
++fi
++eval ac_res=\$$3
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
++$as_echo "$ac_res" >&6; }
++ eval $as_lineno_stack; test "x$as_lineno_stack" = x && { as_lineno=; unset as_lineno;}
++
++} # ac_fn_c_check_header_compile
+ cat >config.log <<_ACEOF
+ This file contains any messages produced by compilers while
+ running configure, to aid debugging if configure makes a mistake.
+
+ It was created by $as_me, which was
+-generated by GNU Autoconf 2.61. Invocation command line was
++generated by GNU Autoconf 2.67. Invocation command line was
+
+ $ $0 $@
+
+@@ -1324,8 +1674,8 @@
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- echo "PATH: $as_dir"
+-done
++ $as_echo "PATH: $as_dir"
++ done
+ IFS=$as_save_IFS
+
+ } >&5
+@@ -1359,12 +1709,12 @@
+ | -silent | --silent | --silen | --sile | --sil)
+ continue ;;
+ *\'*)
+- ac_arg=`echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
++ ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
+ esac
+ case $ac_pass in
+- 1) ac_configure_args0="$ac_configure_args0 '$ac_arg'" ;;
++ 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;;
+ 2)
+- ac_configure_args1="$ac_configure_args1 '$ac_arg'"
++ as_fn_append ac_configure_args1 " '$ac_arg'"
+ if test $ac_must_keep_next = true; then
+ ac_must_keep_next=false # Got value, back to normal.
+ else
+@@ -1380,13 +1730,13 @@
+ -* ) ac_must_keep_next=true ;;
+ esac
+ fi
+- ac_configure_args="$ac_configure_args '$ac_arg'"
++ as_fn_append ac_configure_args " '$ac_arg'"
+ ;;
+ esac
+ done
+ done
+-$as_unset ac_configure_args0 || test "${ac_configure_args0+set}" != set || { ac_configure_args0=; export ac_configure_args0; }
+-$as_unset ac_configure_args1 || test "${ac_configure_args1+set}" != set || { ac_configure_args1=; export ac_configure_args1; }
++{ ac_configure_args0=; unset ac_configure_args0;}
++{ ac_configure_args1=; unset ac_configure_args1;}
+
+ # When interrupted or exit'd, cleanup temporary files, and complete
+ # config.log. We remove comments because anyway the quotes in there
+@@ -1398,11 +1748,9 @@
+ {
+ echo
+
+- cat <<\_ASBOX
+-## ---------------- ##
++ $as_echo "## ---------------- ##
+ ## Cache variables. ##
+-## ---------------- ##
+-_ASBOX
++## ---------------- ##"
+ echo
+ # The following way of writing the cache mishandles newlines in values,
+ (
+@@ -1411,12 +1759,13 @@
+ case $ac_val in #(
+ *${as_nl}*)
+ case $ac_var in #(
+- *_cv_*) { echo "$as_me:$LINENO: WARNING: Cache variable $ac_var contains a newline." >&5
+-echo "$as_me: WARNING: Cache variable $ac_var contains a newline." >&2;} ;;
++ *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
++$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+ esac
+ case $ac_var in #(
+ _ | IFS | as_nl) ;; #(
+- *) $as_unset $ac_var ;;
++ BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #(
++ *) { eval $ac_var=; unset $ac_var;} ;;
+ esac ;;
+ esac
+ done
+@@ -1435,128 +1784,136 @@
+ )
+ echo
+
+- cat <<\_ASBOX
+-## ----------------- ##
++ $as_echo "## ----------------- ##
+ ## Output variables. ##
+-## ----------------- ##
+-_ASBOX
++## ----------------- ##"
+ echo
+ for ac_var in $ac_subst_vars
+ do
+ eval ac_val=\$$ac_var
+ case $ac_val in
+- *\'\''*) ac_val=`echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
++ *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+ esac
+- echo "$ac_var='\''$ac_val'\''"
++ $as_echo "$ac_var='\''$ac_val'\''"
+ done | sort
+ echo
+
+ if test -n "$ac_subst_files"; then
+- cat <<\_ASBOX
+-## ------------------- ##
++ $as_echo "## ------------------- ##
+ ## File substitutions. ##
+-## ------------------- ##
+-_ASBOX
++## ------------------- ##"
+ echo
+ for ac_var in $ac_subst_files
+ do
+ eval ac_val=\$$ac_var
+ case $ac_val in
+- *\'\''*) ac_val=`echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
++ *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+ esac
+- echo "$ac_var='\''$ac_val'\''"
++ $as_echo "$ac_var='\''$ac_val'\''"
+ done | sort
+ echo
+ fi
+
+ if test -s confdefs.h; then
+- cat <<\_ASBOX
+-## ----------- ##
++ $as_echo "## ----------- ##
+ ## confdefs.h. ##
+-## ----------- ##
+-_ASBOX
++## ----------- ##"
+ echo
+ cat confdefs.h
+ echo
+ fi
+ test "$ac_signal" != 0 &&
+- echo "$as_me: caught signal $ac_signal"
+- echo "$as_me: exit $exit_status"
++ $as_echo "$as_me: caught signal $ac_signal"
++ $as_echo "$as_me: exit $exit_status"
+ } >&5
+ rm -f core *.core core.conftest.* &&
+ rm -f -r conftest* confdefs* conf$$* $ac_clean_files &&
+ exit $exit_status
+ ' 0
+ for ac_signal in 1 2 13 15; do
+- trap 'ac_signal='$ac_signal'; { (exit 1); exit 1; }' $ac_signal
++ trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal
+ done
+ ac_signal=0
+
+ # confdefs.h avoids OS command line length limits that DEFS can exceed.
+ rm -f -r conftest* confdefs.h
+
++$as_echo "/* confdefs.h */" > confdefs.h
++
+ # Predefined preprocessor variables.
+
+ cat >>confdefs.h <<_ACEOF
+ #define PACKAGE_NAME "$PACKAGE_NAME"
+ _ACEOF
+
+-
+ cat >>confdefs.h <<_ACEOF
+ #define PACKAGE_TARNAME "$PACKAGE_TARNAME"
+ _ACEOF
+
+-
+ cat >>confdefs.h <<_ACEOF
+ #define PACKAGE_VERSION "$PACKAGE_VERSION"
+ _ACEOF
+
+-
+ cat >>confdefs.h <<_ACEOF
+ #define PACKAGE_STRING "$PACKAGE_STRING"
+ _ACEOF
+
+-
+ cat >>confdefs.h <<_ACEOF
+ #define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT"
+ _ACEOF
+
++cat >>confdefs.h <<_ACEOF
++#define PACKAGE_URL "$PACKAGE_URL"
++_ACEOF
++
+
+ # Let the site file select an alternate cache file if it wants to.
+-# Prefer explicitly selected file to automatically selected ones.
++# Prefer an explicitly selected file to automatically selected ones.
++ac_site_file1=NONE
++ac_site_file2=NONE
+ if test -n "$CONFIG_SITE"; then
+- set x "$CONFIG_SITE"
++ # We do not want a PATH search for config.site.
++ case $CONFIG_SITE in #((
++ -*) ac_site_file1=./$CONFIG_SITE;;
++ */*) ac_site_file1=$CONFIG_SITE;;
++ *) ac_site_file1=./$CONFIG_SITE;;
++ esac
+ elif test "x$prefix" != xNONE; then
+- set x "$prefix/share/config.site" "$prefix/etc/config.site"
++ ac_site_file1=$prefix/share/config.site
++ ac_site_file2=$prefix/etc/config.site
+ else
+- set x "$ac_default_prefix/share/config.site" \
+- "$ac_default_prefix/etc/config.site"
++ ac_site_file1=$ac_default_prefix/share/config.site
++ ac_site_file2=$ac_default_prefix/etc/config.site
+ fi
+-shift
+-for ac_site_file
++for ac_site_file in "$ac_site_file1" "$ac_site_file2"
+ do
+- if test -r "$ac_site_file"; then
+- { echo "$as_me:$LINENO: loading site script $ac_site_file" >&5
+-echo "$as_me: loading site script $ac_site_file" >&6;}
++ test "x$ac_site_file" = xNONE && continue
++ if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then
++ { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
++$as_echo "$as_me: loading site script $ac_site_file" >&6;}
+ sed 's/^/| /' "$ac_site_file" >&5
+- . "$ac_site_file"
++ . "$ac_site_file" \
++ || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
++as_fn_error $? "failed to load site script $ac_site_file
++See \`config.log' for more details" "$LINENO" 5 ; }
+ fi
+ done
+
+ if test -r "$cache_file"; then
+- # Some versions of bash will fail to source /dev/null (special
+- # files actually), so we avoid doing that.
+- if test -f "$cache_file"; then
+- { echo "$as_me:$LINENO: loading cache $cache_file" >&5
+-echo "$as_me: loading cache $cache_file" >&6;}
++ # Some versions of bash will fail to source /dev/null (special files
++ # actually), so we avoid doing that. DJGPP emulates it as a regular file.
++ if test /dev/null != "$cache_file" && test -f "$cache_file"; then
++ { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5
++$as_echo "$as_me: loading cache $cache_file" >&6;}
+ case $cache_file in
+ [\\/]* | ?:[\\/]* ) . "$cache_file";;
+ *) . "./$cache_file";;
+ esac
+ fi
+ else
+- { echo "$as_me:$LINENO: creating cache $cache_file" >&5
+-echo "$as_me: creating cache $cache_file" >&6;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5
++$as_echo "$as_me: creating cache $cache_file" >&6;}
+ >$cache_file
+ fi
+
+@@ -1570,60 +1927,56 @@
+ eval ac_new_val=\$ac_env_${ac_var}_value
+ case $ac_old_set,$ac_new_set in
+ set,)
+- { echo "$as_me:$LINENO: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
+-echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
++$as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
+ ac_cache_corrupted=: ;;
+ ,set)
+- { echo "$as_me:$LINENO: error: \`$ac_var' was not set in the previous run" >&5
+-echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5
++$as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
+ ac_cache_corrupted=: ;;
+ ,);;
+ *)
+ if test "x$ac_old_val" != "x$ac_new_val"; then
+- { echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5
+-echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
+- { echo "$as_me:$LINENO: former value: $ac_old_val" >&5
+-echo "$as_me: former value: $ac_old_val" >&2;}
+- { echo "$as_me:$LINENO: current value: $ac_new_val" >&5
+-echo "$as_me: current value: $ac_new_val" >&2;}
+- ac_cache_corrupted=:
++ # differences in whitespace do not lead to failure.
++ ac_old_val_w=`echo x $ac_old_val`
++ ac_new_val_w=`echo x $ac_new_val`
++ if test "$ac_old_val_w" != "$ac_new_val_w"; then
++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5
++$as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
++ ac_cache_corrupted=:
++ else
++ { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5
++$as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;}
++ eval $ac_var=\$ac_old_val
++ fi
++ { $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5
++$as_echo "$as_me: former value: \`$ac_old_val'" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5
++$as_echo "$as_me: current value: \`$ac_new_val'" >&2;}
+ fi;;
+ esac
+ # Pass precious variables to config.status.
+ if test "$ac_new_set" = set; then
+ case $ac_new_val in
+- *\'*) ac_arg=$ac_var=`echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
++ *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
+ *) ac_arg=$ac_var=$ac_new_val ;;
+ esac
+ case " $ac_configure_args " in
+ *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy.
+- *) ac_configure_args="$ac_configure_args '$ac_arg'" ;;
++ *) as_fn_append ac_configure_args " '$ac_arg'" ;;
+ esac
+ fi
+ done
+ if $ac_cache_corrupted; then
+- { echo "$as_me:$LINENO: error: changes in the environment can compromise the build" >&5
+-echo "$as_me: error: changes in the environment can compromise the build" >&2;}
+- { { echo "$as_me:$LINENO: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&5
+-echo "$as_me: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&2;}
+- { (exit 1); exit 1; }; }
+-fi
+-
+-
+-
+-
+-
+-
+-
+-
+-
+-
+-
+-
+-
+-
+-
+-
++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5
++$as_echo "$as_me: error: changes in the environment can compromise the build" >&2;}
++ as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5
++fi
++## -------------------- ##
++## Main body of script. ##
++## -------------------- ##
+
+ ac_ext=c
+ ac_cpp='$CPP $CPPFLAGS'
+@@ -1635,6 +1988,9 @@
+
+
+
++eap_tnc_cflags=
++eap_tnc_ldflags=-lnaaeap
++
+ if test x$with_rlm_eap_tnc != xno; then
+
+ ac_ext=c
+@@ -1645,10 +2001,10 @@
+ if test -n "$ac_tool_prefix"; then
+ # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args.
+ set dummy ${ac_tool_prefix}gcc; ac_word=$2
+-{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+-if test "${ac_cv_prog_CC+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
++$as_echo_n "checking for $ac_word... " >&6; }
++if test "${ac_cv_prog_CC+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ if test -n "$CC"; then
+ ac_cv_prog_CC="$CC" # Let the user override the test.
+@@ -1658,25 +2014,25 @@
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- for ac_exec_ext in '' $ac_executable_extensions; do
++ for ac_exec_ext in '' $ac_executable_extensions; do
+ if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+ ac_cv_prog_CC="${ac_tool_prefix}gcc"
+- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+ done
+-done
++ done
+ IFS=$as_save_IFS
+
+ fi
+ fi
+ CC=$ac_cv_prog_CC
+ if test -n "$CC"; then
+- { echo "$as_me:$LINENO: result: $CC" >&5
+-echo "${ECHO_T}$CC" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
++$as_echo "$CC" >&6; }
+ else
+- { echo "$as_me:$LINENO: result: no" >&5
+-echo "${ECHO_T}no" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
+ fi
+
+
+@@ -1685,10 +2041,10 @@
+ ac_ct_CC=$CC
+ # Extract the first word of "gcc", so it can be a program name with args.
+ set dummy gcc; ac_word=$2
+-{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+-if test "${ac_cv_prog_ac_ct_CC+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
++$as_echo_n "checking for $ac_word... " >&6; }
++if test "${ac_cv_prog_ac_ct_CC+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ if test -n "$ac_ct_CC"; then
+ ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
+@@ -1698,25 +2054,25 @@
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- for ac_exec_ext in '' $ac_executable_extensions; do
++ for ac_exec_ext in '' $ac_executable_extensions; do
+ if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+ ac_cv_prog_ac_ct_CC="gcc"
+- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+ done
+-done
++ done
+ IFS=$as_save_IFS
+
+ fi
+ fi
+ ac_ct_CC=$ac_cv_prog_ac_ct_CC
+ if test -n "$ac_ct_CC"; then
+- { echo "$as_me:$LINENO: result: $ac_ct_CC" >&5
+-echo "${ECHO_T}$ac_ct_CC" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
++$as_echo "$ac_ct_CC" >&6; }
+ else
+- { echo "$as_me:$LINENO: result: no" >&5
+-echo "${ECHO_T}no" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
+ fi
+
+ if test "x$ac_ct_CC" = x; then
+@@ -1724,12 +2080,8 @@
+ else
+ case $cross_compiling:$ac_tool_warned in
+ yes:)
+-{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools
+-whose name does not start with the host triplet. If you think this
+-configuration is useful to you, please write to autoconf@gnu.org." >&5
+-echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools
+-whose name does not start with the host triplet. If you think this
+-configuration is useful to you, please write to autoconf@gnu.org." >&2;}
++{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
++$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ ac_tool_warned=yes ;;
+ esac
+ CC=$ac_ct_CC
+@@ -1742,10 +2094,10 @@
+ if test -n "$ac_tool_prefix"; then
+ # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args.
+ set dummy ${ac_tool_prefix}cc; ac_word=$2
+-{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+-if test "${ac_cv_prog_CC+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
++$as_echo_n "checking for $ac_word... " >&6; }
++if test "${ac_cv_prog_CC+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ if test -n "$CC"; then
+ ac_cv_prog_CC="$CC" # Let the user override the test.
+@@ -1755,25 +2107,25 @@
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- for ac_exec_ext in '' $ac_executable_extensions; do
++ for ac_exec_ext in '' $ac_executable_extensions; do
+ if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+ ac_cv_prog_CC="${ac_tool_prefix}cc"
+- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+ done
+-done
++ done
+ IFS=$as_save_IFS
+
+ fi
+ fi
+ CC=$ac_cv_prog_CC
+ if test -n "$CC"; then
+- { echo "$as_me:$LINENO: result: $CC" >&5
+-echo "${ECHO_T}$CC" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
++$as_echo "$CC" >&6; }
+ else
+- { echo "$as_me:$LINENO: result: no" >&5
+-echo "${ECHO_T}no" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
+ fi
+
+
+@@ -1782,10 +2134,10 @@
+ if test -z "$CC"; then
+ # Extract the first word of "cc", so it can be a program name with args.
+ set dummy cc; ac_word=$2
+-{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+-if test "${ac_cv_prog_CC+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
++$as_echo_n "checking for $ac_word... " >&6; }
++if test "${ac_cv_prog_CC+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ if test -n "$CC"; then
+ ac_cv_prog_CC="$CC" # Let the user override the test.
+@@ -1796,18 +2148,18 @@
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- for ac_exec_ext in '' $ac_executable_extensions; do
++ for ac_exec_ext in '' $ac_executable_extensions; do
+ if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+ if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
+ ac_prog_rejected=yes
+ continue
+ fi
+ ac_cv_prog_CC="cc"
+- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+ done
+-done
++ done
+ IFS=$as_save_IFS
+
+ if test $ac_prog_rejected = yes; then
+@@ -1826,11 +2178,11 @@
+ fi
+ CC=$ac_cv_prog_CC
+ if test -n "$CC"; then
+- { echo "$as_me:$LINENO: result: $CC" >&5
+-echo "${ECHO_T}$CC" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
++$as_echo "$CC" >&6; }
+ else
+- { echo "$as_me:$LINENO: result: no" >&5
+-echo "${ECHO_T}no" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
+ fi
+
+
+@@ -1841,10 +2193,10 @@
+ do
+ # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
+ set dummy $ac_tool_prefix$ac_prog; ac_word=$2
+-{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+-if test "${ac_cv_prog_CC+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
++$as_echo_n "checking for $ac_word... " >&6; }
++if test "${ac_cv_prog_CC+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ if test -n "$CC"; then
+ ac_cv_prog_CC="$CC" # Let the user override the test.
+@@ -1854,25 +2206,25 @@
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- for ac_exec_ext in '' $ac_executable_extensions; do
++ for ac_exec_ext in '' $ac_executable_extensions; do
+ if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+ ac_cv_prog_CC="$ac_tool_prefix$ac_prog"
+- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+ done
+-done
++ done
+ IFS=$as_save_IFS
+
+ fi
+ fi
+ CC=$ac_cv_prog_CC
+ if test -n "$CC"; then
+- { echo "$as_me:$LINENO: result: $CC" >&5
+-echo "${ECHO_T}$CC" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
++$as_echo "$CC" >&6; }
+ else
+- { echo "$as_me:$LINENO: result: no" >&5
+-echo "${ECHO_T}no" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
+ fi
+
+
+@@ -1885,10 +2237,10 @@
+ do
+ # Extract the first word of "$ac_prog", so it can be a program name with args.
+ set dummy $ac_prog; ac_word=$2
+-{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+-echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+-if test "${ac_cv_prog_ac_ct_CC+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
++$as_echo_n "checking for $ac_word... " >&6; }
++if test "${ac_cv_prog_ac_ct_CC+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ if test -n "$ac_ct_CC"; then
+ ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
+@@ -1898,25 +2250,25 @@
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- for ac_exec_ext in '' $ac_executable_extensions; do
++ for ac_exec_ext in '' $ac_executable_extensions; do
+ if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+ ac_cv_prog_ac_ct_CC="$ac_prog"
+- echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
++ $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+ done
+-done
++ done
+ IFS=$as_save_IFS
+
+ fi
+ fi
+ ac_ct_CC=$ac_cv_prog_ac_ct_CC
+ if test -n "$ac_ct_CC"; then
+- { echo "$as_me:$LINENO: result: $ac_ct_CC" >&5
+-echo "${ECHO_T}$ac_ct_CC" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
++$as_echo "$ac_ct_CC" >&6; }
+ else
+- { echo "$as_me:$LINENO: result: no" >&5
+-echo "${ECHO_T}no" >&6; }
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
+ fi
+
+
+@@ -1928,12 +2280,8 @@
+ else
+ case $cross_compiling:$ac_tool_warned in
+ yes:)
+-{ echo "$as_me:$LINENO: WARNING: In the future, Autoconf will not detect cross-tools
+-whose name does not start with the host triplet. If you think this
+-configuration is useful to you, please write to autoconf@gnu.org." >&5
+-echo "$as_me: WARNING: In the future, Autoconf will not detect cross-tools
+-whose name does not start with the host triplet. If you think this
+-configuration is useful to you, please write to autoconf@gnu.org." >&2;}
++{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
++$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ ac_tool_warned=yes ;;
+ esac
+ CC=$ac_ct_CC
+@@ -1943,51 +2291,37 @@
+ fi
+
+
+-test -z "$CC" && { { echo "$as_me:$LINENO: error: no acceptable C compiler found in \$PATH
+-See \`config.log' for more details." >&5
+-echo "$as_me: error: no acceptable C compiler found in \$PATH
+-See \`config.log' for more details." >&2;}
+- { (exit 1); exit 1; }; }
++test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
++as_fn_error $? "no acceptable C compiler found in \$PATH
++See \`config.log' for more details" "$LINENO" 5 ; }
+
+ # Provide some information about the compiler.
+-echo "$as_me:$LINENO: checking for C compiler version" >&5
+-ac_compiler=`set X $ac_compile; echo $2`
+-{ (ac_try="$ac_compiler --version >&5"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_compiler --version >&5") 2>&5
+- ac_status=$?
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); }
+-{ (ac_try="$ac_compiler -v >&5"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_compiler -v >&5") 2>&5
+- ac_status=$?
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); }
+-{ (ac_try="$ac_compiler -V >&5"
++$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
++set X $ac_compile
++ac_compiler=$2
++for ac_option in --version -v -V -qversion; do
++ { { ac_try="$ac_compiler $ac_option >&5"
+ case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+ esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_compiler -V >&5") 2>&5
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
++ (eval "$ac_compiler $ac_option >&5") 2>conftest.err
+ ac_status=$?
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); }
++ if test -s conftest.err; then
++ sed '10a\
++... rest of stderr output deleted ...
++ 10q' conftest.err >conftest.er1
++ cat conftest.er1 >&5
++ fi
++ rm -f conftest.er1 conftest.err
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; }
++done
+
+-cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h. */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
++cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+
+ int
+@@ -1999,42 +2333,38 @@
+ }
+ _ACEOF
+ ac_clean_files_save=$ac_clean_files
+-ac_clean_files="$ac_clean_files a.out a.exe b.out"
++ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out"
+ # Try to create an executable without -o first, disregard a.out.
+ # It will help us diagnose broken compilers, and finding out an intuition
+ # of exeext.
+-{ echo "$as_me:$LINENO: checking for C compiler default output file name" >&5
+-echo $ECHO_N "checking for C compiler default output file name... $ECHO_C" >&6; }
+-ac_link_default=`echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'`
+-#
+-# List of possible output files, starting from the most likely.
+-# The algorithm is not robust to junk in `.', hence go to wildcards (a.*)
+-# only as a last resort. b.out is created by i960 compilers.
+-ac_files='a_out.exe a.exe conftest.exe a.out conftest a.* conftest.* b.out'
+-#
+-# The IRIX 6 linker writes into existing files which may not be
+-# executable, retaining their permissions. Remove them first so a
+-# subsequent execution test works.
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5
++$as_echo_n "checking whether the C compiler works... " >&6; }
++ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'`
++
++# The possible output files:
++ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*"
++
+ ac_rmfiles=
+ for ac_file in $ac_files
+ do
+ case $ac_file in
+- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ;;
++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;;
+ * ) ac_rmfiles="$ac_rmfiles $ac_file";;
+ esac
+ done
+ rm -f $ac_rmfiles
+
+-if { (ac_try="$ac_link_default"
++if { { ac_try="$ac_link_default"
+ case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+ esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
+ (eval "$ac_link_default") 2>&5
+ ac_status=$?
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); }; then
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; }; then :
+ # Autoconf-2.13 could set the ac_cv_exeext variable to `no'.
+ # So ignore a value of `no', otherwise this would lead to `EXEEXT = no'
+ # in a Makefile. We should not override ac_cv_exeext if it was cached,
+@@ -2044,14 +2374,14 @@
+ do
+ test -f "$ac_file" || continue
+ case $ac_file in
+- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj )
++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj )
+ ;;
+ [ab].out )
+ # We found the default executable, but exeext='' is most
+ # certainly right.
+ break;;
+ *.* )
+- if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no;
++ if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no;
+ then :; else
+ ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'`
+ fi
+@@ -2070,116 +2400,132 @@
+ else
+ ac_file=''
+ fi
+-
+-{ echo "$as_me:$LINENO: result: $ac_file" >&5
+-echo "${ECHO_T}$ac_file" >&6; }
+-if test -z "$ac_file"; then
+- echo "$as_me: failed program was:" >&5
++if test -z "$ac_file"; then :
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
++$as_echo "$as_me: failed program was:" >&5
+ sed 's/^/| /' conftest.$ac_ext >&5
+
+-{ { echo "$as_me:$LINENO: error: C compiler cannot create executables
+-See \`config.log' for more details." >&5
+-echo "$as_me: error: C compiler cannot create executables
+-See \`config.log' for more details." >&2;}
+- { (exit 77); exit 77; }; }
+-fi
+-
++{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
++as_fn_error 77 "C compiler cannot create executables
++See \`config.log' for more details" "$LINENO" 5 ; }
++else
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
++$as_echo "yes" >&6; }
++fi
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5
++$as_echo_n "checking for C compiler default output file name... " >&6; }
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5
++$as_echo "$ac_file" >&6; }
+ ac_exeext=$ac_cv_exeext
+
++rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out
++ac_clean_files=$ac_clean_files_save
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5
++$as_echo_n "checking for suffix of executables... " >&6; }
++if { { ac_try="$ac_link"
++case "(($ac_try" in
++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
++ *) ac_try_echo=$ac_try;;
++esac
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
++ (eval "$ac_link") 2>&5
++ ac_status=$?
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; }; then :
++ # If both `conftest.exe' and `conftest' are `present' (well, observable)
++# catch `conftest.exe'. For instance with Cygwin, `ls conftest' will
++# work properly (i.e., refer to `conftest.exe'), while it won't with
++# `rm'.
++for ac_file in conftest.exe conftest conftest.*; do
++ test -f "$ac_file" || continue
++ case $ac_file in
++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;;
++ *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'`
++ break;;
++ * ) break;;
++ esac
++done
++else
++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
++as_fn_error $? "cannot compute suffix of executables: cannot compile and link
++See \`config.log' for more details" "$LINENO" 5 ; }
++fi
++rm -f conftest conftest$ac_cv_exeext
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5
++$as_echo "$ac_cv_exeext" >&6; }
++
++rm -f conftest.$ac_ext
++EXEEXT=$ac_cv_exeext
++ac_exeext=$EXEEXT
++cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#include <stdio.h>
++int
++main ()
++{
++FILE *f = fopen ("conftest.out", "w");
++ return ferror (f) || fclose (f) != 0;
++
++ ;
++ return 0;
++}
++_ACEOF
++ac_clean_files="$ac_clean_files conftest.out"
+ # Check that the compiler produces executables we can run. If not, either
+ # the compiler is broken, or we cross compile.
+-{ echo "$as_me:$LINENO: checking whether the C compiler works" >&5
+-echo $ECHO_N "checking whether the C compiler works... $ECHO_C" >&6; }
+-# FIXME: These cross compiler hacks should be removed for Autoconf 3.0
+-# If not cross compiling, check that we can run a simple program.
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5
++$as_echo_n "checking whether we are cross compiling... " >&6; }
+ if test "$cross_compiling" != yes; then
+- if { ac_try='./$ac_file'
+- { (case "(($ac_try" in
++ { { ac_try="$ac_link"
++case "(($ac_try" in
++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
++ *) ac_try_echo=$ac_try;;
++esac
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
++ (eval "$ac_link") 2>&5
++ ac_status=$?
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; }
++ if { ac_try='./conftest$ac_cv_exeext'
++ { { case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+ esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
+ (eval "$ac_try") 2>&5
+ ac_status=$?
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); }; }; then
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; }; }; then
+ cross_compiling=no
+ else
+ if test "$cross_compiling" = maybe; then
+ cross_compiling=yes
+ else
+- { { echo "$as_me:$LINENO: error: cannot run C compiled programs.
+-If you meant to cross compile, use \`--host'.
+-See \`config.log' for more details." >&5
+-echo "$as_me: error: cannot run C compiled programs.
++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
++as_fn_error $? "cannot run C compiled programs.
+ If you meant to cross compile, use \`--host'.
+-See \`config.log' for more details." >&2;}
+- { (exit 1); exit 1; }; }
++See \`config.log' for more details" "$LINENO" 5 ; }
+ fi
+ fi
+ fi
+-{ echo "$as_me:$LINENO: result: yes" >&5
+-echo "${ECHO_T}yes" >&6; }
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5
++$as_echo "$cross_compiling" >&6; }
+
+-rm -f a.out a.exe conftest$ac_cv_exeext b.out
++rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out
+ ac_clean_files=$ac_clean_files_save
+-# Check that the compiler produces executables we can run. If not, either
+-# the compiler is broken, or we cross compile.
+-{ echo "$as_me:$LINENO: checking whether we are cross compiling" >&5
+-echo $ECHO_N "checking whether we are cross compiling... $ECHO_C" >&6; }
+-{ echo "$as_me:$LINENO: result: $cross_compiling" >&5
+-echo "${ECHO_T}$cross_compiling" >&6; }
+-
+-{ echo "$as_me:$LINENO: checking for suffix of executables" >&5
+-echo $ECHO_N "checking for suffix of executables... $ECHO_C" >&6; }
+-if { (ac_try="$ac_link"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_link") 2>&5
+- ac_status=$?
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); }; then
+- # If both `conftest.exe' and `conftest' are `present' (well, observable)
+-# catch `conftest.exe'. For instance with Cygwin, `ls conftest' will
+-# work properly (i.e., refer to `conftest.exe'), while it won't with
+-# `rm'.
+-for ac_file in conftest.exe conftest conftest.*; do
+- test -f "$ac_file" || continue
+- case $ac_file in
+- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.o | *.obj ) ;;
+- *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'`
+- break;;
+- * ) break;;
+- esac
+-done
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5
++$as_echo_n "checking for suffix of object files... " >&6; }
++if test "${ac_cv_objext+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+- { { echo "$as_me:$LINENO: error: cannot compute suffix of executables: cannot compile and link
+-See \`config.log' for more details." >&5
+-echo "$as_me: error: cannot compute suffix of executables: cannot compile and link
+-See \`config.log' for more details." >&2;}
+- { (exit 1); exit 1; }; }
+-fi
+-
+-rm -f conftest$ac_cv_exeext
+-{ echo "$as_me:$LINENO: result: $ac_cv_exeext" >&5
+-echo "${ECHO_T}$ac_cv_exeext" >&6; }
+-
+-rm -f conftest.$ac_ext
+-EXEEXT=$ac_cv_exeext
+-ac_exeext=$EXEEXT
+-{ echo "$as_me:$LINENO: checking for suffix of object files" >&5
+-echo $ECHO_N "checking for suffix of object files... $ECHO_C" >&6; }
+-if test "${ac_cv_objext+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
+-else
+- cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h. */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+
+ int
+@@ -2191,51 +2537,46 @@
+ }
+ _ACEOF
+ rm -f conftest.o conftest.obj
+-if { (ac_try="$ac_compile"
++if { { ac_try="$ac_compile"
+ case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+ esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
++eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
++$as_echo "$ac_try_echo"; } >&5
+ (eval "$ac_compile") 2>&5
+ ac_status=$?
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); }; then
++ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
++ test $ac_status = 0; }; then :
+ for ac_file in conftest.o conftest.obj conftest.*; do
+ test -f "$ac_file" || continue;
+ case $ac_file in
+- *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf ) ;;
++ *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;;
+ *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'`
+ break;;
+ esac
+ done
+ else
+- echo "$as_me: failed program was:" >&5
++ $as_echo "$as_me: failed program was:" >&5
+ sed 's/^/| /' conftest.$ac_ext >&5
+
+-{ { echo "$as_me:$LINENO: error: cannot compute suffix of object files: cannot compile
+-See \`config.log' for more details." >&5
+-echo "$as_me: error: cannot compute suffix of object files: cannot compile
+-See \`config.log' for more details." >&2;}
+- { (exit 1); exit 1; }; }
++{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
++as_fn_error $? "cannot compute suffix of object files: cannot compile
++See \`config.log' for more details" "$LINENO" 5 ; }
+ fi
+-
+ rm -f conftest.$ac_cv_objext conftest.$ac_ext
+ fi
+-{ echo "$as_me:$LINENO: result: $ac_cv_objext" >&5
+-echo "${ECHO_T}$ac_cv_objext" >&6; }
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5
++$as_echo "$ac_cv_objext" >&6; }
+ OBJEXT=$ac_cv_objext
+ ac_objext=$OBJEXT
+-{ echo "$as_me:$LINENO: checking whether we are using the GNU C compiler" >&5
+-echo $ECHO_N "checking whether we are using the GNU C compiler... $ECHO_C" >&6; }
+-if test "${ac_cv_c_compiler_gnu+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5
++$as_echo_n "checking whether we are using the GNU C compiler... " >&6; }
++if test "${ac_cv_c_compiler_gnu+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+- cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h. */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+
+ int
+@@ -2249,54 +2590,34 @@
+ return 0;
+ }
+ _ACEOF
+-rm -f conftest.$ac_objext
+-if { (ac_try="$ac_compile"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_compile") 2>conftest.er1
+- ac_status=$?
+- grep -v '^ *+' conftest.er1 >conftest.err
+- rm -f conftest.er1
+- cat conftest.err >&5
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); } && {
+- test -z "$ac_c_werror_flag" ||
+- test ! -s conftest.err
+- } && test -s conftest.$ac_objext; then
++if ac_fn_c_try_compile "$LINENO"; then :
+ ac_compiler_gnu=yes
+ else
+- echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
+-
+- ac_compiler_gnu=no
++ ac_compiler_gnu=no
+ fi
+-
+ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ ac_cv_c_compiler_gnu=$ac_compiler_gnu
+
+ fi
+-{ echo "$as_me:$LINENO: result: $ac_cv_c_compiler_gnu" >&5
+-echo "${ECHO_T}$ac_cv_c_compiler_gnu" >&6; }
+-GCC=`test $ac_compiler_gnu = yes && echo yes`
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
++$as_echo "$ac_cv_c_compiler_gnu" >&6; }
++if test $ac_compiler_gnu = yes; then
++ GCC=yes
++else
++ GCC=
++fi
+ ac_test_CFLAGS=${CFLAGS+set}
+ ac_save_CFLAGS=$CFLAGS
+-{ echo "$as_me:$LINENO: checking whether $CC accepts -g" >&5
+-echo $ECHO_N "checking whether $CC accepts -g... $ECHO_C" >&6; }
+-if test "${ac_cv_prog_cc_g+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
++$as_echo_n "checking whether $CC accepts -g... " >&6; }
++if test "${ac_cv_prog_cc_g+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ ac_save_c_werror_flag=$ac_c_werror_flag
+ ac_c_werror_flag=yes
+ ac_cv_prog_cc_g=no
+ CFLAGS="-g"
+- cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h. */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+
+ int
+@@ -2307,34 +2628,11 @@
+ return 0;
+ }
+ _ACEOF
+-rm -f conftest.$ac_objext
+-if { (ac_try="$ac_compile"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_compile") 2>conftest.er1
+- ac_status=$?
+- grep -v '^ *+' conftest.er1 >conftest.err
+- rm -f conftest.er1
+- cat conftest.err >&5
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); } && {
+- test -z "$ac_c_werror_flag" ||
+- test ! -s conftest.err
+- } && test -s conftest.$ac_objext; then
++if ac_fn_c_try_compile "$LINENO"; then :
+ ac_cv_prog_cc_g=yes
+ else
+- echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
+-
+- CFLAGS=""
+- cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h. */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
++ CFLAGS=""
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+
+ int
+@@ -2345,35 +2643,12 @@
+ return 0;
+ }
+ _ACEOF
+-rm -f conftest.$ac_objext
+-if { (ac_try="$ac_compile"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_compile") 2>conftest.er1
+- ac_status=$?
+- grep -v '^ *+' conftest.er1 >conftest.err
+- rm -f conftest.er1
+- cat conftest.err >&5
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); } && {
+- test -z "$ac_c_werror_flag" ||
+- test ! -s conftest.err
+- } && test -s conftest.$ac_objext; then
+- :
+-else
+- echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
++if ac_fn_c_try_compile "$LINENO"; then :
+
+- ac_c_werror_flag=$ac_save_c_werror_flag
++else
++ ac_c_werror_flag=$ac_save_c_werror_flag
+ CFLAGS="-g"
+- cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h. */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+
+ int
+@@ -2384,42 +2659,18 @@
+ return 0;
+ }
+ _ACEOF
+-rm -f conftest.$ac_objext
+-if { (ac_try="$ac_compile"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_compile") 2>conftest.er1
+- ac_status=$?
+- grep -v '^ *+' conftest.er1 >conftest.err
+- rm -f conftest.er1
+- cat conftest.err >&5
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); } && {
+- test -z "$ac_c_werror_flag" ||
+- test ! -s conftest.err
+- } && test -s conftest.$ac_objext; then
++if ac_fn_c_try_compile "$LINENO"; then :
+ ac_cv_prog_cc_g=yes
+-else
+- echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
+-
+-
+ fi
+-
+ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ fi
+-
+ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ fi
+-
+ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ ac_c_werror_flag=$ac_save_c_werror_flag
+ fi
+-{ echo "$as_me:$LINENO: result: $ac_cv_prog_cc_g" >&5
+-echo "${ECHO_T}$ac_cv_prog_cc_g" >&6; }
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
++$as_echo "$ac_cv_prog_cc_g" >&6; }
+ if test "$ac_test_CFLAGS" = set; then
+ CFLAGS=$ac_save_CFLAGS
+ elif test $ac_cv_prog_cc_g = yes; then
+@@ -2435,18 +2686,14 @@
+ CFLAGS=
+ fi
+ fi
+-{ echo "$as_me:$LINENO: checking for $CC option to accept ISO C89" >&5
+-echo $ECHO_N "checking for $CC option to accept ISO C89... $ECHO_C" >&6; }
+-if test "${ac_cv_prog_cc_c89+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
++$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
++if test "${ac_cv_prog_cc_c89+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ ac_cv_prog_cc_c89=no
+ ac_save_CC=$CC
+-cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h. */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
++cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+ #include <stdarg.h>
+ #include <stdio.h>
+@@ -2503,31 +2750,9 @@
+ -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
+ do
+ CC="$ac_save_CC $ac_arg"
+- rm -f conftest.$ac_objext
+-if { (ac_try="$ac_compile"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_compile") 2>conftest.er1
+- ac_status=$?
+- grep -v '^ *+' conftest.er1 >conftest.err
+- rm -f conftest.er1
+- cat conftest.err >&5
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); } && {
+- test -z "$ac_c_werror_flag" ||
+- test ! -s conftest.err
+- } && test -s conftest.$ac_objext; then
++ if ac_fn_c_try_compile "$LINENO"; then :
+ ac_cv_prog_cc_c89=$ac_arg
+-else
+- echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
+-
+-
+ fi
+-
+ rm -f core conftest.err conftest.$ac_objext
+ test "x$ac_cv_prog_cc_c89" != "xno" && break
+ done
+@@ -2538,17 +2763,19 @@
+ # AC_CACHE_VAL
+ case "x$ac_cv_prog_cc_c89" in
+ x)
+- { echo "$as_me:$LINENO: result: none needed" >&5
+-echo "${ECHO_T}none needed" >&6; } ;;
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
++$as_echo "none needed" >&6; } ;;
+ xno)
+- { echo "$as_me:$LINENO: result: unsupported" >&5
+-echo "${ECHO_T}unsupported" >&6; } ;;
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
++$as_echo "unsupported" >&6; } ;;
+ *)
+ CC="$CC $ac_cv_prog_cc_c89"
+- { echo "$as_me:$LINENO: result: $ac_cv_prog_cc_c89" >&5
+-echo "${ECHO_T}$ac_cv_prog_cc_c89" >&6; } ;;
++ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
++$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
+ esac
++if test "x$ac_cv_prog_cc_c89" != xno; then :
+
++fi
+
+ ac_ext=c
+ ac_cpp='$CPP $CPPFLAGS'
+@@ -2557,81 +2784,474 @@
+ ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
+
+-
+-{ echo "$as_me:$LINENO: checking for exchangeTNCCSMessages in -lTNCS" >&5
+-echo $ECHO_N "checking for exchangeTNCCSMessages in -lTNCS... $ECHO_C" >&6; }
+-if test "${ac_cv_lib_TNCS_exchangeTNCCSMessages+set}" = set; then
+- echo $ECHO_N "(cached) $ECHO_C" >&6
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for processEAPTNCData in -lnaaeap" >&5
++$as_echo_n "checking for processEAPTNCData in -lnaaeap... " >&6; }
++if test "${ac_cv_lib_naaeap_processEAPTNCData+set}" = set; then :
++ $as_echo_n "(cached) " >&6
+ else
+ ac_check_lib_save_LIBS=$LIBS
+-LIBS="-lTNCS $LIBS"
+-cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h. */
++LIBS="-lnaaeap $LIBS"
++cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++
++/* Override any GCC internal prototype to avoid an error.
++ Use char because int might match the return type of a GCC
++ builtin and then its argument prototype would still apply. */
++#ifdef __cplusplus
++extern "C"
++#endif
++char processEAPTNCData ();
++int
++main ()
++{
++return processEAPTNCData ();
++ ;
++ return 0;
++}
++_ACEOF
++if ac_fn_c_try_link "$LINENO"; then :
++ ac_cv_lib_naaeap_processEAPTNCData=yes
++else
++ ac_cv_lib_naaeap_processEAPTNCData=no
++fi
++rm -f core conftest.err conftest.$ac_objext \
++ conftest$ac_exeext conftest.$ac_ext
++LIBS=$ac_check_lib_save_LIBS
++fi
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_naaeap_processEAPTNCData" >&5
++$as_echo "$ac_cv_lib_naaeap_processEAPTNCData" >&6; }
++if test "x$ac_cv_lib_naaeap_processEAPTNCData" = x""yes; then :
++ cat >>confdefs.h <<_ACEOF
++#define HAVE_LIBNAAEAP 1
++_ACEOF
++
++ LIBS="-lnaaeap $LIBS"
++
++else
++ fail="$fail -lnaaeap"
++fi
++
++ if test -x"$ac_cv_lib_NAAEAP_processEAPTNCData" == -x"no"; then
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: the NAAEAP library was not found!" >&5
++$as_echo "$as_me: WARNING: the NAAEAP library was not found!" >&2;}
++ fail="$fail -lNAAEAP"
++ fi
++
++ ac_ext=c
++ac_cpp='$CPP $CPPFLAGS'
++ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
++ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
++ac_compiler_gnu=$ac_cv_c_compiler_gnu
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
++$as_echo_n "checking how to run the C preprocessor... " >&6; }
++# On Suns, sometimes $CPP names a directory.
++if test -n "$CPP" && test -d "$CPP"; then
++ CPP=
++fi
++if test -z "$CPP"; then
++ if test "${ac_cv_prog_CPP+set}" = set; then :
++ $as_echo_n "(cached) " >&6
++else
++ # Double quotes because CPP needs to be expanded
++ for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp"
++ do
++ ac_preproc_ok=false
++for ac_c_preproc_warn_flag in '' yes
++do
++ # Use a header file that comes with gcc, so configuring glibc
++ # with a fresh cross-compiler works.
++ # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
++ # <limits.h> exists even on freestanding compilers.
++ # On the NeXT, cc -E runs the code through the compiler's parser,
++ # not just through cpp. "Syntax error" is here to catch this case.
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#ifdef __STDC__
++# include <limits.h>
++#else
++# include <assert.h>
++#endif
++ Syntax error
++_ACEOF
++if ac_fn_c_try_cpp "$LINENO"; then :
++
++else
++ # Broken: fails on valid input.
++continue
++fi
++rm -f conftest.err conftest.i conftest.$ac_ext
++
++ # OK, works on sane cases. Now check whether nonexistent headers
++ # can be detected and how.
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#include <ac_nonexistent.h>
++_ACEOF
++if ac_fn_c_try_cpp "$LINENO"; then :
++ # Broken: success on invalid input.
++continue
++else
++ # Passes both tests.
++ac_preproc_ok=:
++break
++fi
++rm -f conftest.err conftest.i conftest.$ac_ext
++
++done
++# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
++rm -f conftest.i conftest.err conftest.$ac_ext
++if $ac_preproc_ok; then :
++ break
++fi
++
++ done
++ ac_cv_prog_CPP=$CPP
++
++fi
++ CPP=$ac_cv_prog_CPP
++else
++ ac_cv_prog_CPP=$CPP
++fi
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
++$as_echo "$CPP" >&6; }
++ac_preproc_ok=false
++for ac_c_preproc_warn_flag in '' yes
++do
++ # Use a header file that comes with gcc, so configuring glibc
++ # with a fresh cross-compiler works.
++ # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
++ # <limits.h> exists even on freestanding compilers.
++ # On the NeXT, cc -E runs the code through the compiler's parser,
++ # not just through cpp. "Syntax error" is here to catch this case.
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#ifdef __STDC__
++# include <limits.h>
++#else
++# include <assert.h>
++#endif
++ Syntax error
++_ACEOF
++if ac_fn_c_try_cpp "$LINENO"; then :
++
++else
++ # Broken: fails on valid input.
++continue
++fi
++rm -f conftest.err conftest.i conftest.$ac_ext
++
++ # OK, works on sane cases. Now check whether nonexistent headers
++ # can be detected and how.
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#include <ac_nonexistent.h>
++_ACEOF
++if ac_fn_c_try_cpp "$LINENO"; then :
++ # Broken: success on invalid input.
++continue
++else
++ # Passes both tests.
++ac_preproc_ok=:
++break
++fi
++rm -f conftest.err conftest.i conftest.$ac_ext
++
++done
++# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
++rm -f conftest.i conftest.err conftest.$ac_ext
++if $ac_preproc_ok; then :
++
++else
++ { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
++$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
++as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
++See \`config.log' for more details" "$LINENO" 5 ; }
++fi
++
++ac_ext=c
++ac_cpp='$CPP $CPPFLAGS'
++ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
++ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
++ac_compiler_gnu=$ac_cv_c_compiler_gnu
++
++
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5
++$as_echo_n "checking for grep that handles long lines and -e... " >&6; }
++if test "${ac_cv_path_GREP+set}" = set; then :
++ $as_echo_n "(cached) " >&6
++else
++ if test -z "$GREP"; then
++ ac_path_GREP_found=false
++ # Loop through the user's path and test for each of PROGNAME-LIST
++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
++for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
++do
++ IFS=$as_save_IFS
++ test -z "$as_dir" && as_dir=.
++ for ac_prog in grep ggrep; do
++ for ac_exec_ext in '' $ac_executable_extensions; do
++ ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext"
++ { test -f "$ac_path_GREP" && $as_test_x "$ac_path_GREP"; } || continue
++# Check for GNU ac_path_GREP and select it if it is found.
++ # Check for GNU $ac_path_GREP
++case `"$ac_path_GREP" --version 2>&1` in
++*GNU*)
++ ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;;
++*)
++ ac_count=0
++ $as_echo_n 0123456789 >"conftest.in"
++ while :
++ do
++ cat "conftest.in" "conftest.in" >"conftest.tmp"
++ mv "conftest.tmp" "conftest.in"
++ cp "conftest.in" "conftest.nl"
++ $as_echo 'GREP' >> "conftest.nl"
++ "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break
++ diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
++ as_fn_arith $ac_count + 1 && ac_count=$as_val
++ if test $ac_count -gt ${ac_path_GREP_max-0}; then
++ # Best one so far, save it but keep looking for a better one
++ ac_cv_path_GREP="$ac_path_GREP"
++ ac_path_GREP_max=$ac_count
++ fi
++ # 10*(2^10) chars as input seems more than enough
++ test $ac_count -gt 10 && break
++ done
++ rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
++esac
++
++ $ac_path_GREP_found && break 3
++ done
++ done
++ done
++IFS=$as_save_IFS
++ if test -z "$ac_cv_path_GREP"; then
++ as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
++ fi
++else
++ ac_cv_path_GREP=$GREP
++fi
++
++fi
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5
++$as_echo "$ac_cv_path_GREP" >&6; }
++ GREP="$ac_cv_path_GREP"
++
++
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
++$as_echo_n "checking for egrep... " >&6; }
++if test "${ac_cv_path_EGREP+set}" = set; then :
++ $as_echo_n "(cached) " >&6
++else
++ if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
++ then ac_cv_path_EGREP="$GREP -E"
++ else
++ if test -z "$EGREP"; then
++ ac_path_EGREP_found=false
++ # Loop through the user's path and test for each of PROGNAME-LIST
++ as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
++for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
++do
++ IFS=$as_save_IFS
++ test -z "$as_dir" && as_dir=.
++ for ac_prog in egrep; do
++ for ac_exec_ext in '' $ac_executable_extensions; do
++ ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
++ { test -f "$ac_path_EGREP" && $as_test_x "$ac_path_EGREP"; } || continue
++# Check for GNU ac_path_EGREP and select it if it is found.
++ # Check for GNU $ac_path_EGREP
++case `"$ac_path_EGREP" --version 2>&1` in
++*GNU*)
++ ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
++*)
++ ac_count=0
++ $as_echo_n 0123456789 >"conftest.in"
++ while :
++ do
++ cat "conftest.in" "conftest.in" >"conftest.tmp"
++ mv "conftest.tmp" "conftest.in"
++ cp "conftest.in" "conftest.nl"
++ $as_echo 'EGREP' >> "conftest.nl"
++ "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
++ diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
++ as_fn_arith $ac_count + 1 && ac_count=$as_val
++ if test $ac_count -gt ${ac_path_EGREP_max-0}; then
++ # Best one so far, save it but keep looking for a better one
++ ac_cv_path_EGREP="$ac_path_EGREP"
++ ac_path_EGREP_max=$ac_count
++ fi
++ # 10*(2^10) chars as input seems more than enough
++ test $ac_count -gt 10 && break
++ done
++ rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
++esac
++
++ $ac_path_EGREP_found && break 3
++ done
++ done
++ done
++IFS=$as_save_IFS
++ if test -z "$ac_cv_path_EGREP"; then
++ as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
++ fi
++else
++ ac_cv_path_EGREP=$EGREP
++fi
++
++ fi
++fi
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
++$as_echo "$ac_cv_path_EGREP" >&6; }
++ EGREP="$ac_cv_path_EGREP"
++
++
++{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
++$as_echo_n "checking for ANSI C header files... " >&6; }
++if test "${ac_cv_header_stdc+set}" = set; then :
++ $as_echo_n "(cached) " >&6
++else
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#include <stdlib.h>
++#include <stdarg.h>
++#include <string.h>
++#include <float.h>
++
++int
++main ()
++{
++
++ ;
++ return 0;
++}
++_ACEOF
++if ac_fn_c_try_compile "$LINENO"; then :
++ ac_cv_header_stdc=yes
++else
++ ac_cv_header_stdc=no
++fi
++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
++
++if test $ac_cv_header_stdc = yes; then
++ # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#include <string.h>
++
+ _ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
++if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
++ $EGREP "memchr" >/dev/null 2>&1; then :
++
++else
++ ac_cv_header_stdc=no
++fi
++rm -f conftest*
++
++fi
++
++if test $ac_cv_header_stdc = yes; then
++ # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h. */
++#include <stdlib.h>
++
++_ACEOF
++if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
++ $EGREP "free" >/dev/null 2>&1; then :
++
++else
++ ac_cv_header_stdc=no
++fi
++rm -f conftest*
++
++fi
++
++if test $ac_cv_header_stdc = yes; then
++ # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
++ if test "$cross_compiling" = yes; then :
++ :
++else
++ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h. */
+-
+-/* Override any GCC internal prototype to avoid an error.
+- Use char because int might match the return type of a GCC
+- builtin and then its argument prototype would still apply. */
+-#ifdef __cplusplus
+-extern "C"
++#include <ctype.h>
++#include <stdlib.h>
++#if ((' ' & 0x0FF) == 0x020)
++# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
++# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
++#else
++# define ISLOWER(c) \
++ (('a' <= (c) && (c) <= 'i') \
++ || ('j' <= (c) && (c) <= 'r') \
++ || ('s' <= (c) && (c) <= 'z'))
++# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
+ #endif
+-char exchangeTNCCSMessages ();
++
++#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
+ int
+ main ()
+ {
+-return exchangeTNCCSMessages ();
+- ;
++ int i;
++ for (i = 0; i < 256; i++)
++ if (XOR (islower (i), ISLOWER (i))
++ || toupper (i) != TOUPPER (i))
++ return 2;
+ return 0;
+ }
+ _ACEOF
+-rm -f conftest.$ac_objext conftest$ac_exeext
+-if { (ac_try="$ac_link"
+-case "(($ac_try" in
+- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+- *) ac_try_echo=$ac_try;;
+-esac
+-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+- (eval "$ac_link") 2>conftest.er1
+- ac_status=$?
+- grep -v '^ *+' conftest.er1 >conftest.err
+- rm -f conftest.er1
+- cat conftest.err >&5
+- echo "$as_me:$LINENO: \$? = $ac_status" >&5
+- (exit $ac_status); } && {
+- test -z "$ac_c_werror_flag" ||
+- test ! -s conftest.err
+- } && test -s conftest$ac_exeext &&
+- $as_test_x conftest$ac_exeext; then
+- ac_cv_lib_TNCS_exchangeTNCCSMessages=yes
++if ac_fn_c_try_run "$LINENO"; then :
++
+ else
+- echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
++ ac_cv_header_stdc=no
++fi
++rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
++ conftest.$ac_objext conftest.beam conftest.$ac_ext
++fi
+
+- ac_cv_lib_TNCS_exchangeTNCCSMessages=no
+ fi
++fi
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
++$as_echo "$ac_cv_header_stdc" >&6; }
++if test $ac_cv_header_stdc = yes; then
++
++$as_echo "#define STDC_HEADERS 1" >>confdefs.h
+
+-rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+- conftest$ac_exeext conftest.$ac_ext
+-LIBS=$ac_check_lib_save_LIBS
+ fi
+-{ echo "$as_me:$LINENO: result: $ac_cv_lib_TNCS_exchangeTNCCSMessages" >&5
+-echo "${ECHO_T}$ac_cv_lib_TNCS_exchangeTNCCSMessages" >&6; }
+-if test $ac_cv_lib_TNCS_exchangeTNCCSMessages = yes; then
++
++# On IRIX 5.3, sys/types and inttypes.h are conflicting.
++for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \
++ inttypes.h stdint.h unistd.h
++do :
++ as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
++ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
++"
++if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+ cat >>confdefs.h <<_ACEOF
+-#define HAVE_LIBTNCS 1
++#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+ _ACEOF
+
+- LIBS="-lTNCS $LIBS"
++fi
++
++done
++
++
++for ac_header in naaeap/naaeap.h
++do :
++ ac_fn_c_check_header_mongrel "$LINENO" "naaeap/naaeap.h" "ac_cv_header_naaeap_naaeap_h" "$ac_includes_default"
++if test "x$ac_cv_header_naaeap_naaeap_h" = x""yes; then :
++ cat >>confdefs.h <<_ACEOF
++#define HAVE_NAAEAP_NAAEAP_H 1
++_ACEOF
+
++else
++ fail="$fail -Inaaeap.h"
+ fi
+
+- if test "x$ac_cv_lib_tncs_exchangetnccsmessages" != xyes; then
+- { echo "$as_me:$LINENO: WARNING: the TNCS library isn't found!" >&5
+-echo "$as_me: WARNING: the TNCS library isn't found!" >&2;}
+- fail="$fail -lTNCS"
++done
++
++ if test -x"$ac_cv_header_naaeap_h" == -x"no"; then
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: the naaeap header was not found!" >&5
++$as_echo "$as_me: WARNING: the naaeap header was not found!" >&2;}
++ fail="$fail -Inaaeap.h"
+ fi
+
+ targetname=rlm_eap_tnc
+@@ -2642,14 +3262,12 @@
+
+ if test x"$fail" != x""; then
+ if test x"${enable_strict_dependencies}" = x"yes"; then
+- { { echo "$as_me:$LINENO: error: set --without-rlm_eap_tnc to disable it explicitly." >&5
+-echo "$as_me: error: set --without-rlm_eap_tnc to disable it explicitly." >&2;}
+- { (exit 1); exit 1; }; }
++ as_fn_error $? "set --without-rlm_eap_tnc to disable it explicitly." "$LINENO" 5
+ else
+- { echo "$as_me:$LINENO: WARNING: silently not building rlm_eap_tnc." >&5
+-echo "$as_me: WARNING: silently not building rlm_eap_tnc." >&2;}
+- { echo "$as_me:$LINENO: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&5
+-echo "$as_me: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&2;};
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: silently not building rlm_eap_tnc." >&5
++$as_echo "$as_me: WARNING: silently not building rlm_eap_tnc." >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&5
++$as_echo "$as_me: WARNING: FAILURE: rlm_eap_tnc requires: $fail." >&2;};
+ targetname=""
+ fi
+ fi
+@@ -2658,11 +3276,7 @@
+
+
+
+-
+- unset ac_cv_env_LIBS_set
+- unset ac_cv_env_LIBS_value
+-
+- ac_config_files="$ac_config_files Makefile"
++ac_config_files="$ac_config_files Makefile"
+
+ cat >confcache <<\_ACEOF
+ # This file is a shell script that caches the results of configure
+@@ -2691,12 +3305,13 @@
+ case $ac_val in #(
+ *${as_nl}*)
+ case $ac_var in #(
+- *_cv_*) { echo "$as_me:$LINENO: WARNING: Cache variable $ac_var contains a newline." >&5
+-echo "$as_me: WARNING: Cache variable $ac_var contains a newline." >&2;} ;;
++ *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
++$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+ esac
+ case $ac_var in #(
+ _ | IFS | as_nl) ;; #(
+- *) $as_unset $ac_var ;;
++ BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #(
++ *) { eval $ac_var=; unset $ac_var;} ;;
+ esac ;;
+ esac
+ done
+@@ -2704,8 +3319,8 @@
+ (set) 2>&1 |
+ case $as_nl`(ac_space=' '; set) 2>&1` in #(
+ *${as_nl}ac_space=\ *)
+- # `set' does not quote correctly, so add quotes (double-quote
+- # substitution turns \\\\ into \\, and sed turns \\ into \).
++ # `set' does not quote correctly, so add quotes: double-quote
++ # substitution turns \\\\ into \\, and sed turns \\ into \.
+ sed -n \
+ "s/'/'\\\\''/g;
+ s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p"
+@@ -2728,12 +3343,12 @@
+ if diff "$cache_file" confcache >/dev/null 2>&1; then :; else
+ if test -w "$cache_file"; then
+ test "x$cache_file" != "x/dev/null" &&
+- { echo "$as_me:$LINENO: updating cache $cache_file" >&5
+-echo "$as_me: updating cache $cache_file" >&6;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5
++$as_echo "$as_me: updating cache $cache_file" >&6;}
+ cat confcache >$cache_file
+ else
+- { echo "$as_me:$LINENO: not updating unwritable cache $cache_file" >&5
+-echo "$as_me: not updating unwritable cache $cache_file" >&6;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5
++$as_echo "$as_me: not updating unwritable cache $cache_file" >&6;}
+ fi
+ fi
+ rm -f confcache
+@@ -2750,6 +3365,12 @@
+ # take arguments), then branch to the quote section. Otherwise,
+ # look for a macro that doesn't take arguments.
+ ac_script='
++:mline
++/\\$/{
++ N
++ s,\\\n,,
++ b mline
++}
+ t clear
+ :clear
+ s/^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*([^)]*)\)[ ]*\(.*\)/-D\1=\2/g
+@@ -2776,14 +3397,15 @@
+
+ ac_libobjs=
+ ac_ltlibobjs=
++U=
+ for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue
+ # 1. Remove the extension, and $U if already installed.
+ ac_script='s/\$U\././;s/\.o$//;s/\.obj$//'
+- ac_i=`echo "$ac_i" | sed "$ac_script"`
++ ac_i=`$as_echo "$ac_i" | sed "$ac_script"`
+ # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR
+ # will be set to the directory where LIBOBJS objects are built.
+- ac_libobjs="$ac_libobjs \${LIBOBJDIR}$ac_i\$U.$ac_objext"
+- ac_ltlibobjs="$ac_ltlibobjs \${LIBOBJDIR}$ac_i"'$U.lo'
++ as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext"
++ as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo'
+ done
+ LIBOBJS=$ac_libobjs
+
+@@ -2792,11 +3414,13 @@
+
+
+ : ${CONFIG_STATUS=./config.status}
++ac_write_fail=0
+ ac_clean_files_save=$ac_clean_files
+ ac_clean_files="$ac_clean_files $CONFIG_STATUS"
+-{ echo "$as_me:$LINENO: creating $CONFIG_STATUS" >&5
+-echo "$as_me: creating $CONFIG_STATUS" >&6;}
+-cat >$CONFIG_STATUS <<_ACEOF
++{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5
++$as_echo "$as_me: creating $CONFIG_STATUS" >&6;}
++as_write_fail=0
++cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1
+ #! $SHELL
+ # Generated by $as_me.
+ # Run this file to recreate the current configuration.
+@@ -2806,59 +3430,79 @@
+ debug=false
+ ac_cs_recheck=false
+ ac_cs_silent=false
+-SHELL=\${CONFIG_SHELL-$SHELL}
+-_ACEOF
+
+-cat >>$CONFIG_STATUS <<\_ACEOF
+-## --------------------- ##
+-## M4sh Initialization. ##
+-## --------------------- ##
++SHELL=\${CONFIG_SHELL-$SHELL}
++export SHELL
++_ASEOF
++cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1
++## -------------------- ##
++## M4sh Initialization. ##
++## -------------------- ##
+
+ # Be more Bourne compatible
+ DUALCASE=1; export DUALCASE # for MKS sh
+-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
++if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+ emulate sh
+ NULLCMD=:
+- # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which
++ # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
+ # is contrary to our usage. Disable this feature.
+ alias -g '${1+"$@"}'='"$@"'
+ setopt NO_GLOB_SUBST
+ else
+- case `(set -o) 2>/dev/null` in
+- *posix*) set -o posix ;;
++ case `(set -o) 2>/dev/null` in #(
++ *posix*) :
++ set -o posix ;; #(
++ *) :
++ ;;
+ esac
+-
+ fi
+
+
+-
+-
+-# PATH needs CR
+-# Avoid depending upon Character Ranges.
+-as_cr_letters='abcdefghijklmnopqrstuvwxyz'
+-as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+-as_cr_Letters=$as_cr_letters$as_cr_LETTERS
+-as_cr_digits='0123456789'
+-as_cr_alnum=$as_cr_Letters$as_cr_digits
+-
+-# The user is always right.
+-if test "${PATH_SEPARATOR+set}" != set; then
+- echo "#! /bin/sh" >conf$$.sh
+- echo "exit 0" >>conf$$.sh
+- chmod +x conf$$.sh
+- if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then
+- PATH_SEPARATOR=';'
++as_nl='
++'
++export as_nl
++# Printing a long string crashes Solaris 7 /usr/bin/printf.
++as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
++as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
++# Prefer a ksh shell builtin over an external printf program on Solaris,
++# but without wasting forks for bash or zsh.
++if test -z "$BASH_VERSION$ZSH_VERSION" \
++ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
++ as_echo='print -r --'
++ as_echo_n='print -rn --'
++elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
++ as_echo='printf %s\n'
++ as_echo_n='printf %s'
++else
++ if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
++ as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
++ as_echo_n='/usr/ucb/echo -n'
+ else
+- PATH_SEPARATOR=:
++ as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
++ as_echo_n_body='eval
++ arg=$1;
++ case $arg in #(
++ *"$as_nl"*)
++ expr "X$arg" : "X\\(.*\\)$as_nl";
++ arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
++ esac;
++ expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
++ '
++ export as_echo_n_body
++ as_echo_n='sh -c $as_echo_n_body as_echo'
+ fi
+- rm -f conf$$.sh
++ export as_echo_body
++ as_echo='sh -c $as_echo_body as_echo'
+ fi
+
+-# Support unset when possible.
+-if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then
+- as_unset=unset
+-else
+- as_unset=false
++# The user is always right.
++if test "${PATH_SEPARATOR+set}" != set; then
++ PATH_SEPARATOR=:
++ (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
++ (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
++ PATH_SEPARATOR=';'
++ }
+ fi
+
+
+@@ -2867,20 +3511,18 @@
+ # there to prevent editors from complaining about space-tab.
+ # (If _AS_PATH_WALK were called with IFS unset, it would disable word
+ # splitting by setting IFS to empty value.)
+-as_nl='
+-'
+ IFS=" "" $as_nl"
+
+ # Find who we are. Look in the path if we contain no directory separator.
+-case $0 in
++case $0 in #((
+ *[\\/]* ) as_myself=$0 ;;
+ *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+ for as_dir in $PATH
+ do
+ IFS=$as_save_IFS
+ test -z "$as_dir" && as_dir=.
+- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+-done
++ test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
++ done
+ IFS=$as_save_IFS
+
+ ;;
+@@ -2891,32 +3533,111 @@
+ as_myself=$0
+ fi
+ if test ! -f "$as_myself"; then
+- echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+- { (exit 1); exit 1; }
++ $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
++ exit 1
+ fi
+
+-# Work around bugs in pre-3.0 UWIN ksh.
+-for as_var in ENV MAIL MAILPATH
+-do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
++# Unset variables that we do not need and which cause bugs (e.g. in
++# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1"
++# suppresses any "Segmentation fault" message there. '((' could
++# trigger a bug in pdksh 5.2.14.
++for as_var in BASH_ENV ENV MAIL MAILPATH
++do eval test x\${$as_var+set} = xset \
++ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+ done
+ PS1='$ '
+ PS2='> '
+ PS4='+ '
+
+ # NLS nuisances.
+-for as_var in \
+- LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \
+- LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \
+- LC_TELEPHONE LC_TIME
+-do
+- if (set +x; test -z "`(eval $as_var=C; export $as_var) 2>&1`"); then
+- eval $as_var=C; export $as_var
+- else
+- ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var
++LC_ALL=C
++export LC_ALL
++LANGUAGE=C
++export LANGUAGE
++
++# CDPATH.
++(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
++
++
++# as_fn_error STATUS ERROR [LINENO LOG_FD]
++# ----------------------------------------
++# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
++# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
++# script with STATUS, using 1 if that was 0.
++as_fn_error ()
++{
++ as_status=$1; test $as_status -eq 0 && as_status=1
++ if test "$4"; then
++ as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
++ $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
+ fi
+-done
++ $as_echo "$as_me: error: $2" >&2
++ as_fn_exit $as_status
++} # as_fn_error
++
++
++# as_fn_set_status STATUS
++# -----------------------
++# Set $? to STATUS, without forking.
++as_fn_set_status ()
++{
++ return $1
++} # as_fn_set_status
++
++# as_fn_exit STATUS
++# -----------------
++# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
++as_fn_exit ()
++{
++ set +e
++ as_fn_set_status $1
++ exit $1
++} # as_fn_exit
++
++# as_fn_unset VAR
++# ---------------
++# Portably unset VAR.
++as_fn_unset ()
++{
++ { eval $1=; unset $1;}
++}
++as_unset=as_fn_unset
++# as_fn_append VAR VALUE
++# ----------------------
++# Append the text in VALUE to the end of the definition contained in VAR. Take
++# advantage of any shell optimizations that allow amortized linear growth over
++# repeated appends, instead of the typical quadratic growth present in naive
++# implementations.
++if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
++ eval 'as_fn_append ()
++ {
++ eval $1+=\$2
++ }'
++else
++ as_fn_append ()
++ {
++ eval $1=\$$1\$2
++ }
++fi # as_fn_append
++
++# as_fn_arith ARG...
++# ------------------
++# Perform arithmetic evaluation on the ARGs, and store the result in the
++# global $as_val. Take advantage of shells that can avoid forks. The arguments
++# must be portable across $(()) and expr.
++if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
++ eval 'as_fn_arith ()
++ {
++ as_val=$(( $* ))
++ }'
++else
++ as_fn_arith ()
++ {
++ as_val=`expr "$@" || test $? -eq 1`
++ }
++fi # as_fn_arith
++
+
+-# Required to use basename.
+ if expr a : '\(a\)' >/dev/null 2>&1 &&
+ test "X`expr 00001 : '.*\(...\)'`" = X001; then
+ as_expr=expr
+@@ -2930,13 +3651,17 @@
+ as_basename=false
+ fi
+
++if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
++ as_dirname=dirname
++else
++ as_dirname=false
++fi
+
+-# Name of the executable.
+ as_me=`$as_basename -- "$0" ||
+ $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
+ X"$0" : 'X\(//\)$' \| \
+ X"$0" : 'X\(/\)' \| . 2>/dev/null ||
+-echo X/"$0" |
++$as_echo X/"$0" |
+ sed '/^.*\/\([^/][^/]*\)\/*$/{
+ s//\1/
+ q
+@@ -2951,104 +3676,103 @@
+ }
+ s/.*/./; q'`
+
+-# CDPATH.
+-$as_unset CDPATH
+-
+-
+-
+- as_lineno_1=$LINENO
+- as_lineno_2=$LINENO
+- test "x$as_lineno_1" != "x$as_lineno_2" &&
+- test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || {
+-
+- # Create $as_me.lineno as a copy of $as_myself, but with $LINENO
+- # uniformly replaced by the line number. The first 'sed' inserts a
+- # line-number line after each line using $LINENO; the second 'sed'
+- # does the real work. The second script uses 'N' to pair each
+- # line-number line with the line containing $LINENO, and appends
+- # trailing '-' during substitution so that $LINENO is not a special
+- # case at line end.
+- # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the
+- # scripts with optimization help from Paolo Bonzini. Blame Lee
+- # E. McMahon (1931-1989) for sed's syntax. :-)
+- sed -n '
+- p
+- /[$]LINENO/=
+- ' <$as_myself |
+- sed '
+- s/[$]LINENO.*/&-/
+- t lineno
+- b
+- :lineno
+- N
+- :loop
+- s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/
+- t loop
+- s/-\n.*//
+- ' >$as_me.lineno &&
+- chmod +x "$as_me.lineno" ||
+- { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2
+- { (exit 1); exit 1; }; }
+-
+- # Don't try to exec as it changes $[0], causing all sort of problems
+- # (the dirname of $[0] is not the place where we might find the
+- # original and so on. Autoconf is especially sensitive to this).
+- . "./$as_me.lineno"
+- # Exit status is that of the last command.
+- exit
+-}
+-
+-
+-if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
+- as_dirname=dirname
+-else
+- as_dirname=false
+-fi
++# Avoid depending upon Character Ranges.
++as_cr_letters='abcdefghijklmnopqrstuvwxyz'
++as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
++as_cr_Letters=$as_cr_letters$as_cr_LETTERS
++as_cr_digits='0123456789'
++as_cr_alnum=$as_cr_Letters$as_cr_digits
+
+ ECHO_C= ECHO_N= ECHO_T=
+-case `echo -n x` in
++case `echo -n x` in #(((((
+ -n*)
+- case `echo 'x\c'` in
++ case `echo 'xy\c'` in
+ *c*) ECHO_T=' ';; # ECHO_T is single tab character.
+- *) ECHO_C='\c';;
++ xy) ECHO_C='\c';;
++ *) echo `echo ksh88 bug on AIX 6.1` > /dev/null
++ ECHO_T=' ';;
+ esac;;
+ *)
+ ECHO_N='-n';;
+ esac
+
+-if expr a : '\(a\)' >/dev/null 2>&1 &&
+- test "X`expr 00001 : '.*\(...\)'`" = X001; then
+- as_expr=expr
+-else
+- as_expr=false
+-fi
+-
+ rm -f conf$$ conf$$.exe conf$$.file
+ if test -d conf$$.dir; then
+ rm -f conf$$.dir/conf$$.file
+ else
+ rm -f conf$$.dir
+- mkdir conf$$.dir
++ mkdir conf$$.dir 2>/dev/null
+ fi
+-echo >conf$$.file
+-if ln -s conf$$.file conf$$ 2>/dev/null; then
+- as_ln_s='ln -s'
+- # ... but there are two gotchas:
+- # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
+- # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
+- # In both cases, we have to default to `cp -p'.
+- ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
++if (echo >conf$$.file) 2>/dev/null; then
++ if ln -s conf$$.file conf$$ 2>/dev/null; then
++ as_ln_s='ln -s'
++ # ... but there are two gotchas:
++ # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
++ # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
++ # In both cases, we have to default to `cp -p'.
++ ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
++ as_ln_s='cp -p'
++ elif ln conf$$.file conf$$ 2>/dev/null; then
++ as_ln_s=ln
++ else
+ as_ln_s='cp -p'
+-elif ln conf$$.file conf$$ 2>/dev/null; then
+- as_ln_s=ln
++ fi
+ else
+ as_ln_s='cp -p'
+ fi
+ rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file
+ rmdir conf$$.dir 2>/dev/null
+
++
++# as_fn_mkdir_p
++# -------------
++# Create "$as_dir" as a directory, including parents if necessary.
++as_fn_mkdir_p ()
++{
++
++ case $as_dir in #(
++ -*) as_dir=./$as_dir;;
++ esac
++ test -d "$as_dir" || eval $as_mkdir_p || {
++ as_dirs=
++ while :; do
++ case $as_dir in #(
++ *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
++ *) as_qdir=$as_dir;;
++ esac
++ as_dirs="'$as_qdir' $as_dirs"
++ as_dir=`$as_dirname -- "$as_dir" ||
++$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
++ X"$as_dir" : 'X\(//\)[^/]' \| \
++ X"$as_dir" : 'X\(//\)$' \| \
++ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
++$as_echo X"$as_dir" |
++ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
++ s//\1/
++ q
++ }
++ /^X\(\/\/\)[^/].*/{
++ s//\1/
++ q
++ }
++ /^X\(\/\/\)$/{
++ s//\1/
++ q
++ }
++ /^X\(\/\).*/{
++ s//\1/
++ q
++ }
++ s/.*/./; q'`
++ test -d "$as_dir" && break
++ done
++ test -z "$as_dirs" || eval "mkdir $as_dirs"
++ } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir"
++
++
++} # as_fn_mkdir_p
+ if mkdir -p . 2>/dev/null; then
+- as_mkdir_p=:
++ as_mkdir_p='mkdir -p "$as_dir"'
+ else
+ test -d ./-p && rmdir ./-p
+ as_mkdir_p=false
+@@ -3065,12 +3789,12 @@
+ as_test_x='
+ eval sh -c '\''
+ if test -d "$1"; then
+- test -d "$1/.";
++ test -d "$1/.";
+ else
+- case $1 in
+- -*)set "./$1";;
++ case $1 in #(
++ -*)set "./$1";;
+ esac;
+- case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in
++ case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in #((
+ ???[sx]*):;;*)false;;esac;fi
+ '\'' sh
+ '
+@@ -3085,13 +3809,19 @@
+
+
+ exec 6>&1
++## ----------------------------------- ##
++## Main body of $CONFIG_STATUS script. ##
++## ----------------------------------- ##
++_ASEOF
++test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1
+
+-# Save the log message, to keep $[0] and so on meaningful, and to
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
++# Save the log message, to keep $0 and so on meaningful, and to
+ # report actual input values of CONFIG_FILES etc. instead of their
+ # values after options handling.
+ ac_log="
+ This file was extended by $as_me, which was
+-generated by GNU Autoconf 2.61. Invocation command line was
++generated by GNU Autoconf 2.67. Invocation command line was
+
+ CONFIG_FILES = $CONFIG_FILES
+ CONFIG_HEADERS = $CONFIG_HEADERS
+@@ -3104,59 +3834,74 @@
+
+ _ACEOF
+
+-cat >>$CONFIG_STATUS <<_ACEOF
++case $ac_config_files in *"
++"*) set x $ac_config_files; shift; ac_config_files=$*;;
++esac
++
++
++
++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ # Files that config.status was made for.
+ config_files="$ac_config_files"
+
+ _ACEOF
+
+-cat >>$CONFIG_STATUS <<\_ACEOF
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+ ac_cs_usage="\
+-\`$as_me' instantiates files from templates according to the
+-current configuration.
++\`$as_me' instantiates files and other configuration actions
++from templates according to the current configuration. Unless the files
++and actions are specified as TAGs, all are instantiated by default.
+
+-Usage: $0 [OPTIONS] [FILE]...
++Usage: $0 [OPTION]... [TAG]...
+
+ -h, --help print this help, then exit
+ -V, --version print version number and configuration settings, then exit
+- -q, --quiet do not print progress messages
++ --config print configuration, then exit
++ -q, --quiet, --silent
++ do not print progress messages
+ -d, --debug don't remove temporary files
+ --recheck update $as_me by reconfiguring in the same conditions
+- --file=FILE[:TEMPLATE]
+- instantiate the configuration file FILE
++ --file=FILE[:TEMPLATE]
++ instantiate the configuration file FILE
+
+ Configuration files:
+ $config_files
+
+-Report bugs to <bug-autoconf@gnu.org>."
++Report bugs to the package provider."
+
+ _ACEOF
+-cat >>$CONFIG_STATUS <<_ACEOF
++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
++ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ ac_cs_version="\\
+ config.status
+-configured by $0, generated by GNU Autoconf 2.61,
+- with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
++configured by $0, generated by GNU Autoconf 2.67,
++ with options \\"\$ac_cs_config\\"
+
+-Copyright (C) 2006 Free Software Foundation, Inc.
++Copyright (C) 2010 Free Software Foundation, Inc.
+ This config.status script is free software; the Free Software Foundation
+ gives unlimited permission to copy, distribute and modify it."
+
+ ac_pwd='$ac_pwd'
+ srcdir='$srcdir'
++test -n "\$AWK" || AWK=awk
+ _ACEOF
+
+-cat >>$CONFIG_STATUS <<\_ACEOF
+-# If no file are specified by the user, then we need to provide default
+-# value. By we need to know if files were specified by the user.
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
++# The default lists apply if the user does not specify any file.
+ ac_need_defaults=:
+ while test $# != 0
+ do
+ case $1 in
+- --*=*)
++ --*=?*)
+ ac_option=`expr "X$1" : 'X\([^=]*\)='`
+ ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'`
+ ac_shift=:
+ ;;
++ --*=)
++ ac_option=`expr "X$1" : 'X\([^=]*\)='`
++ ac_optarg=
++ ac_shift=:
++ ;;
+ *)
+ ac_option=$1
+ ac_optarg=$2
+@@ -3169,25 +3914,30 @@
+ -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r)
+ ac_cs_recheck=: ;;
+ --version | --versio | --versi | --vers | --ver | --ve | --v | -V )
+- echo "$ac_cs_version"; exit ;;
++ $as_echo "$ac_cs_version"; exit ;;
++ --config | --confi | --conf | --con | --co | --c )
++ $as_echo "$ac_cs_config"; exit ;;
+ --debug | --debu | --deb | --de | --d | -d )
+ debug=: ;;
+ --file | --fil | --fi | --f )
+ $ac_shift
+- CONFIG_FILES="$CONFIG_FILES $ac_optarg"
++ case $ac_optarg in
++ *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
++ '') as_fn_error $? "missing file argument" ;;
++ esac
++ as_fn_append CONFIG_FILES " '$ac_optarg'"
+ ac_need_defaults=false;;
+ --he | --h | --help | --hel | -h )
+- echo "$ac_cs_usage"; exit ;;
++ $as_echo "$ac_cs_usage"; exit ;;
+ -q | -quiet | --quiet | --quie | --qui | --qu | --q \
+ | -silent | --silent | --silen | --sile | --sil | --si | --s)
+ ac_cs_silent=: ;;
+
+ # This is an error.
+- -*) { echo "$as_me: error: unrecognized option: $1
+-Try \`$0 --help' for more information." >&2
+- { (exit 1); exit 1; }; } ;;
++ -*) as_fn_error $? "unrecognized option: \`$1'
++Try \`$0 --help' for more information." ;;
+
+- *) ac_config_targets="$ac_config_targets $1"
++ *) as_fn_append ac_config_targets " $1"
+ ac_need_defaults=false ;;
+
+ esac
+@@ -3202,30 +3952,32 @@
+ fi
+
+ _ACEOF
+-cat >>$CONFIG_STATUS <<_ACEOF
++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ if \$ac_cs_recheck; then
+- echo "running CONFIG_SHELL=$SHELL $SHELL $0 "$ac_configure_args \$ac_configure_extra_args " --no-create --no-recursion" >&6
+- CONFIG_SHELL=$SHELL
++ set X '$SHELL' '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion
++ shift
++ \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6
++ CONFIG_SHELL='$SHELL'
+ export CONFIG_SHELL
+- exec $SHELL "$0"$ac_configure_args \$ac_configure_extra_args --no-create --no-recursion
++ exec "\$@"
+ fi
+
+ _ACEOF
+-cat >>$CONFIG_STATUS <<\_ACEOF
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+ exec 5>>config.log
+ {
+ echo
+ sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX
+ ## Running $as_me. ##
+ _ASBOX
+- echo "$ac_log"
++ $as_echo "$ac_log"
+ } >&5
+
+ _ACEOF
+-cat >>$CONFIG_STATUS <<_ACEOF
++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ _ACEOF
+
+-cat >>$CONFIG_STATUS <<\_ACEOF
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+
+ # Handling of arguments.
+ for ac_config_target in $ac_config_targets
+@@ -3233,9 +3985,7 @@
+ case $ac_config_target in
+ "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
+
+- *) { { echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5
+-echo "$as_me: error: invalid argument: $ac_config_target" >&2;}
+- { (exit 1); exit 1; }; };;
++ *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5 ;;
+ esac
+ done
+
+@@ -3260,7 +4010,7 @@
+ trap 'exit_status=$?
+ { test -z "$tmp" || test ! -d "$tmp" || rm -fr "$tmp"; } && exit $exit_status
+ ' 0
+- trap '{ (exit 1); exit 1; }' 1 2 13 15
++ trap 'as_fn_exit 1' 1 2 13 15
+ }
+ # Create a (secure) tmp directory for tmp files.
+
+@@ -3271,145 +4021,177 @@
+ {
+ tmp=./conf$$-$RANDOM
+ (umask 077 && mkdir "$tmp")
+-} ||
+-{
+- echo "$me: cannot create a temporary directory in ." >&2
+- { (exit 1); exit 1; }
+-}
+-
+-#
+-# Set up the sed scripts for CONFIG_FILES section.
+-#
++} || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5
+
+-# No need to generate the scripts if there are no CONFIG_FILES.
+-# This happens for instance when ./config.status config.h
++# Set up the scripts for CONFIG_FILES section.
++# No need to generate them if there are no CONFIG_FILES.
++# This happens for instance with `./config.status config.h'.
+ if test -n "$CONFIG_FILES"; then
+
+-_ACEOF
+
++ac_cr=`echo X | tr X '\015'`
++# On cygwin, bash can eat \r inside `` if the user requested igncr.
++# But we know of no other shell where ac_cr would be empty at this
++# point, so we can use a bashism as a fallback.
++if test "x$ac_cr" = x; then
++ eval ac_cr=\$\'\\r\'
++fi
++ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' </dev/null 2>/dev/null`
++if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then
++ ac_cs_awk_cr='\\r'
++else
++ ac_cs_awk_cr=$ac_cr
++fi
++
++echo 'BEGIN {' >"$tmp/subs1.awk" &&
++_ACEOF
+
+
++{
++ echo "cat >conf$$subs.awk <<_ACEOF" &&
++ echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' &&
++ echo "_ACEOF"
++} >conf$$subs.sh ||
++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
++ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'`
+ ac_delim='%!_!# '
+ for ac_last_try in false false false false false :; do
+- cat >conf$$subs.sed <<_ACEOF
+-SHELL!$SHELL$ac_delim
+-PATH_SEPARATOR!$PATH_SEPARATOR$ac_delim
+-PACKAGE_NAME!$PACKAGE_NAME$ac_delim
+-PACKAGE_TARNAME!$PACKAGE_TARNAME$ac_delim
+-PACKAGE_VERSION!$PACKAGE_VERSION$ac_delim
+-PACKAGE_STRING!$PACKAGE_STRING$ac_delim
+-PACKAGE_BUGREPORT!$PACKAGE_BUGREPORT$ac_delim
+-exec_prefix!$exec_prefix$ac_delim
+-prefix!$prefix$ac_delim
+-program_transform_name!$program_transform_name$ac_delim
+-bindir!$bindir$ac_delim
+-sbindir!$sbindir$ac_delim
+-libexecdir!$libexecdir$ac_delim
+-datarootdir!$datarootdir$ac_delim
+-datadir!$datadir$ac_delim
+-sysconfdir!$sysconfdir$ac_delim
+-sharedstatedir!$sharedstatedir$ac_delim
+-localstatedir!$localstatedir$ac_delim
+-includedir!$includedir$ac_delim
+-oldincludedir!$oldincludedir$ac_delim
+-docdir!$docdir$ac_delim
+-infodir!$infodir$ac_delim
+-htmldir!$htmldir$ac_delim
+-dvidir!$dvidir$ac_delim
+-pdfdir!$pdfdir$ac_delim
+-psdir!$psdir$ac_delim
+-libdir!$libdir$ac_delim
+-localedir!$localedir$ac_delim
+-mandir!$mandir$ac_delim
+-DEFS!$DEFS$ac_delim
+-ECHO_C!$ECHO_C$ac_delim
+-ECHO_N!$ECHO_N$ac_delim
+-ECHO_T!$ECHO_T$ac_delim
+-LIBS!$LIBS$ac_delim
+-build_alias!$build_alias$ac_delim
+-host_alias!$host_alias$ac_delim
+-target_alias!$target_alias$ac_delim
+-CC!$CC$ac_delim
+-CFLAGS!$CFLAGS$ac_delim
+-LDFLAGS!$LDFLAGS$ac_delim
+-CPPFLAGS!$CPPFLAGS$ac_delim
+-ac_ct_CC!$ac_ct_CC$ac_delim
+-EXEEXT!$EXEEXT$ac_delim
+-OBJEXT!$OBJEXT$ac_delim
+-eap_tnc_cflags!$eap_tnc_cflags$ac_delim
+-eap_tnc_ldflags!$eap_tnc_ldflags$ac_delim
+-targetname!$targetname$ac_delim
+-LIBOBJS!$LIBOBJS$ac_delim
+-LTLIBOBJS!$LTLIBOBJS$ac_delim
+-_ACEOF
++ . ./conf$$subs.sh ||
++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
+
+- if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 49; then
++ ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X`
++ if test $ac_delim_n = $ac_delim_num; then
+ break
+ elif $ac_last_try; then
+- { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
+-echo "$as_me: error: could not make $CONFIG_STATUS" >&2;}
+- { (exit 1); exit 1; }; }
++ as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
+ else
+ ac_delim="$ac_delim!$ac_delim _$ac_delim!! "
+ fi
+ done
++rm -f conf$$subs.sh
+
+-ac_eof=`sed -n '/^CEOF[0-9]*$/s/CEOF/0/p' conf$$subs.sed`
+-if test -n "$ac_eof"; then
+- ac_eof=`echo "$ac_eof" | sort -nru | sed 1q`
+- ac_eof=`expr $ac_eof + 1`
+-fi
+-
+-cat >>$CONFIG_STATUS <<_ACEOF
+-cat >"\$tmp/subs-1.sed" <<\CEOF$ac_eof
+-/@[a-zA-Z_][a-zA-Z_0-9]*@/!b end
+-_ACEOF
+-sed '
+-s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g
+-s/^/s,@/; s/!/@,|#_!!_#|/
+-:n
+-t n
+-s/'"$ac_delim"'$/,g/; t
+-s/$/\\/; p
+-N; s/^.*\n//; s/[,\\&]/\\&/g; s/@/@|#_!!_#|/g; b n
+-' >>$CONFIG_STATUS <conf$$subs.sed
+-rm -f conf$$subs.sed
+-cat >>$CONFIG_STATUS <<_ACEOF
+-:end
+-s/|#_!!_#|//g
+-CEOF$ac_eof
++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
++cat >>"\$tmp/subs1.awk" <<\\_ACAWK &&
+ _ACEOF
++sed -n '
++h
++s/^/S["/; s/!.*/"]=/
++p
++g
++s/^[^!]*!//
++:repl
++t repl
++s/'"$ac_delim"'$//
++t delim
++:nl
++h
++s/\(.\{148\}\)..*/\1/
++t more1
++s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/
++p
++n
++b repl
++:more1
++s/["\\]/\\&/g; s/^/"/; s/$/"\\/
++p
++g
++s/.\{148\}//
++t nl
++:delim
++h
++s/\(.\{148\}\)..*/\1/
++t more2
++s/["\\]/\\&/g; s/^/"/; s/$/"/
++p
++b
++:more2
++s/["\\]/\\&/g; s/^/"/; s/$/"\\/
++p
++g
++s/.\{148\}//
++t delim
++' <conf$$subs.awk | sed '
++/^[^""]/{
++ N
++ s/\n//
++}
++' >>$CONFIG_STATUS || ac_write_fail=1
++rm -f conf$$subs.awk
++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
++_ACAWK
++cat >>"\$tmp/subs1.awk" <<_ACAWK &&
++ for (key in S) S_is_set[key] = 1
++ FS = ""
++
++}
++{
++ line = $ 0
++ nfields = split(line, field, "@")
++ substed = 0
++ len = length(field[1])
++ for (i = 2; i < nfields; i++) {
++ key = field[i]
++ keylen = length(key)
++ if (S_is_set[key]) {
++ value = S[key]
++ line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3)
++ len += length(value) + length(field[++i])
++ substed = 1
++ } else
++ len += 1 + keylen
++ }
++
++ print line
++}
+
++_ACAWK
++_ACEOF
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
++if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then
++ sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g"
++else
++ cat
++fi < "$tmp/subs1.awk" > "$tmp/subs.awk" \
++ || as_fn_error $? "could not setup config files machinery" "$LINENO" 5
++_ACEOF
+
+-# VPATH may cause trouble with some makes, so we remove $(srcdir),
+-# ${srcdir} and @srcdir@ from VPATH if srcdir is ".", strip leading and
++# VPATH may cause trouble with some makes, so we remove sole $(srcdir),
++# ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and
+ # trailing colons and then remove the whole line if VPATH becomes empty
+ # (actually we leave an empty line to preserve line numbers).
+ if test "x$srcdir" = x.; then
+- ac_vpsub='/^[ ]*VPATH[ ]*=/{
+-s/:*\$(srcdir):*/:/
+-s/:*\${srcdir}:*/:/
+-s/:*@srcdir@:*/:/
+-s/^\([^=]*=[ ]*\):*/\1/
++ ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{
++h
++s///
++s/^/:/
++s/[ ]*$/:/
++s/:\$(srcdir):/:/g
++s/:\${srcdir}:/:/g
++s/:@srcdir@:/:/g
++s/^:*//
+ s/:*$//
++x
++s/\(=[ ]*\).*/\1/
++G
++s/\n//
+ s/^[^=]*=[ ]*$//
+ }'
+ fi
+
+-cat >>$CONFIG_STATUS <<\_ACEOF
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+ fi # test -n "$CONFIG_FILES"
+
+
+-for ac_tag in :F $CONFIG_FILES
++eval set X " :F $CONFIG_FILES "
++shift
++for ac_tag
+ do
+ case $ac_tag in
+ :[FHLC]) ac_mode=$ac_tag; continue;;
+ esac
+ case $ac_mode$ac_tag in
+ :[FHL]*:*);;
+- :L* | :C*:*) { { echo "$as_me:$LINENO: error: Invalid tag $ac_tag." >&5
+-echo "$as_me: error: Invalid tag $ac_tag." >&2;}
+- { (exit 1); exit 1; }; };;
++ :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5 ;;
+ :[FH]-) ac_tag=-:-;;
+ :[FH]*) ac_tag=$ac_tag:$ac_tag.in;;
+ esac
+@@ -3437,26 +4219,34 @@
+ [\\/$]*) false;;
+ *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";;
+ esac ||
+- { { echo "$as_me:$LINENO: error: cannot find input file: $ac_f" >&5
+-echo "$as_me: error: cannot find input file: $ac_f" >&2;}
+- { (exit 1); exit 1; }; };;
++ as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5 ;;
+ esac
+- ac_file_inputs="$ac_file_inputs $ac_f"
++ case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac
++ as_fn_append ac_file_inputs " '$ac_f'"
+ done
+
+ # Let's still pretend it is `configure' which instantiates (i.e., don't
+ # use $as_me), people would be surprised to read:
+ # /* config.h. Generated by config.status. */
+- configure_input="Generated from "`IFS=:
+- echo $* | sed 's|^[^:]*/||;s|:[^:]*/|, |g'`" by configure."
++ configure_input='Generated from '`
++ $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g'
++ `' by configure.'
+ if test x"$ac_file" != x-; then
+ configure_input="$ac_file. $configure_input"
+- { echo "$as_me:$LINENO: creating $ac_file" >&5
+-echo "$as_me: creating $ac_file" >&6;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5
++$as_echo "$as_me: creating $ac_file" >&6;}
+ fi
++ # Neutralize special characters interpreted by sed in replacement strings.
++ case $configure_input in #(
++ *\&* | *\|* | *\\* )
++ ac_sed_conf_input=`$as_echo "$configure_input" |
++ sed 's/[\\\\&|]/\\\\&/g'`;; #(
++ *) ac_sed_conf_input=$configure_input;;
++ esac
+
+ case $ac_tag in
+- *:-:* | *:-) cat >"$tmp/stdin";;
++ *:-:* | *:-) cat >"$tmp/stdin" \
++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;;
+ esac
+ ;;
+ esac
+@@ -3466,42 +4256,7 @@
+ X"$ac_file" : 'X\(//\)[^/]' \| \
+ X"$ac_file" : 'X\(//\)$' \| \
+ X"$ac_file" : 'X\(/\)' \| . 2>/dev/null ||
+-echo X"$ac_file" |
+- sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+- s//\1/
+- q
+- }
+- /^X\(\/\/\)[^/].*/{
+- s//\1/
+- q
+- }
+- /^X\(\/\/\)$/{
+- s//\1/
+- q
+- }
+- /^X\(\/\).*/{
+- s//\1/
+- q
+- }
+- s/.*/./; q'`
+- { as_dir="$ac_dir"
+- case $as_dir in #(
+- -*) as_dir=./$as_dir;;
+- esac
+- test -d "$as_dir" || { $as_mkdir_p && mkdir -p "$as_dir"; } || {
+- as_dirs=
+- while :; do
+- case $as_dir in #(
+- *\'*) as_qdir=`echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #(
+- *) as_qdir=$as_dir;;
+- esac
+- as_dirs="'$as_qdir' $as_dirs"
+- as_dir=`$as_dirname -- "$as_dir" ||
+-$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+- X"$as_dir" : 'X\(//\)[^/]' \| \
+- X"$as_dir" : 'X\(//\)$' \| \
+- X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
+-echo X"$as_dir" |
++$as_echo X"$ac_file" |
+ sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+ s//\1/
+ q
+@@ -3519,20 +4274,15 @@
+ q
+ }
+ s/.*/./; q'`
+- test -d "$as_dir" && break
+- done
+- test -z "$as_dirs" || eval "mkdir $as_dirs"
+- } || test -d "$as_dir" || { { echo "$as_me:$LINENO: error: cannot create directory $as_dir" >&5
+-echo "$as_me: error: cannot create directory $as_dir" >&2;}
+- { (exit 1); exit 1; }; }; }
++ as_dir="$ac_dir"; as_fn_mkdir_p
+ ac_builddir=.
+
+ case "$ac_dir" in
+ .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
+ *)
+- ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'`
++ ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'`
+ # A ".." for each directory in $ac_dir_suffix.
+- ac_top_builddir_sub=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,/..,g;s,/,,'`
++ ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
+ case $ac_top_builddir_sub in
+ "") ac_top_builddir_sub=. ac_top_build_prefix= ;;
+ *) ac_top_build_prefix=$ac_top_builddir_sub/ ;;
+@@ -3568,12 +4318,12 @@
+
+ _ACEOF
+
+-cat >>$CONFIG_STATUS <<\_ACEOF
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+ # If the template does not know about datarootdir, expand it.
+ # FIXME: This hack should be removed a few years after 2.60.
+ ac_datarootdir_hack=; ac_datarootdir_seen=
+-
+-case `sed -n '/datarootdir/ {
++ac_sed_dataroot='
++/datarootdir/ {
+ p
+ q
+ }
+@@ -3581,36 +4331,37 @@
+ /@docdir@/p
+ /@infodir@/p
+ /@localedir@/p
+-/@mandir@/p
+-' $ac_file_inputs` in
++/@mandir@/p'
++case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in
+ *datarootdir*) ac_datarootdir_seen=yes;;
+ *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*)
+- { echo "$as_me:$LINENO: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
+-echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
++$as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
+ _ACEOF
+-cat >>$CONFIG_STATUS <<_ACEOF
++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ ac_datarootdir_hack='
+ s&@datadir@&$datadir&g
+ s&@docdir@&$docdir&g
+ s&@infodir@&$infodir&g
+ s&@localedir@&$localedir&g
+ s&@mandir@&$mandir&g
+- s&\\\${datarootdir}&$datarootdir&g' ;;
++ s&\\\${datarootdir}&$datarootdir&g' ;;
+ esac
+ _ACEOF
+
+ # Neutralize VPATH when `$srcdir' = `.'.
+ # Shell code in configure.ac might set extrasub.
+ # FIXME: do we really want to maintain this feature?
+-cat >>$CONFIG_STATUS <<_ACEOF
+- sed "$ac_vpsub
++cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
++ac_sed_extra="$ac_vpsub
+ $extrasub
+ _ACEOF
+-cat >>$CONFIG_STATUS <<\_ACEOF
++cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+ :t
+ /@[a-zA-Z_][a-zA-Z_0-9]*@/!b
+-s&@configure_input@&$configure_input&;t t
++s|@configure_input@|$ac_sed_conf_input|;t t
+ s&@top_builddir@&$ac_top_builddir_sub&;t t
++s&@top_build_prefix@&$ac_top_build_prefix&;t t
+ s&@srcdir@&$ac_srcdir&;t t
+ s&@abs_srcdir@&$ac_abs_srcdir&;t t
+ s&@top_srcdir@&$ac_top_srcdir&;t t
+@@ -3619,21 +4370,24 @@
+ s&@abs_builddir@&$ac_abs_builddir&;t t
+ s&@abs_top_builddir@&$ac_abs_top_builddir&;t t
+ $ac_datarootdir_hack
+-" $ac_file_inputs | sed -f "$tmp/subs-1.sed" >$tmp/out
++"
++eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$tmp/subs.awk" >$tmp/out \
++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5
+
+ test -z "$ac_datarootdir_hack$ac_datarootdir_seen" &&
+ { ac_out=`sed -n '/\${datarootdir}/p' "$tmp/out"`; test -n "$ac_out"; } &&
+ { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' "$tmp/out"`; test -z "$ac_out"; } &&
+- { echo "$as_me:$LINENO: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+-which seems to be undefined. Please make sure it is defined." >&5
+-echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+-which seems to be undefined. Please make sure it is defined." >&2;}
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir'
++which seems to be undefined. Please make sure it is defined" >&5
++$as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
++which seems to be undefined. Please make sure it is defined" >&2;}
+
+ rm -f "$tmp/stdin"
+ case $ac_file in
+- -) cat "$tmp/out"; rm -f "$tmp/out";;
+- *) rm -f "$ac_file"; mv "$tmp/out" $ac_file;;
+- esac
++ -) cat "$tmp/out" && rm -f "$tmp/out";;
++ *) rm -f "$ac_file" && mv "$tmp/out" "$ac_file";;
++ esac \
++ || as_fn_error $? "could not create $ac_file" "$LINENO" 5
+ ;;
+
+
+@@ -3643,11 +4397,13 @@
+ done # for ac_tag
+
+
+-{ (exit 0); exit 0; }
++as_fn_exit 0
+ _ACEOF
+-chmod +x $CONFIG_STATUS
+ ac_clean_files=$ac_clean_files_save
+
++test $ac_write_fail = 0 ||
++ as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5
++
+
+ # configure is writing to config.log, and then calls config.status.
+ # config.status does its own redirection, appending to config.log.
+@@ -3667,7 +4423,10 @@
+ exec 5>>config.log
+ # Use ||, not &&, to avoid exiting from the if with $? = 1, which
+ # would make configure fail if this is the last instruction.
+- $ac_cs_success || { (exit 1); exit 1; }
++ $ac_cs_success || as_fn_exit 1
++fi
++if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then
++ { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
++$as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
+ fi
+-
+
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/configure.in 2012-12-04 19:38:00.241420966 +0100
+@@ -2,12 +2,21 @@
+ AC_REVISION($Revision$)
+ AC_DEFUN(modname,[rlm_eap_tnc])
+
++eap_tnc_cflags=
++eap_tnc_ldflags=-lnaaeap
++
+ if test x$with_[]modname != xno; then
+
+- AC_CHECK_LIB(TNCS, exchangeTNCCSMessages)
+- if test "x$ac_cv_lib_tncs_exchangetnccsmessages" != xyes; then
+- AC_MSG_WARN([the TNCS library isn't found!])
+- fail="$fail -lTNCS"
++ AC_CHECK_LIB(naaeap,processEAPTNCData,,fail="$fail -lnaaeap",)
++ if test -x"$ac_cv_lib_NAAEAP_processEAPTNCData" == -x"no"; then
++ AC_MSG_WARN([the NAAEAP library was not found!])
++ fail="$fail -lNAAEAP"
++ fi
++
++ AC_CHECK_HEADERS(naaeap/naaeap.h,,fail="$fail -Inaaeap.h",)
++ if test -x"$ac_cv_header_naaeap_h" == -x"no"; then
++ AC_MSG_WARN([the naaeap header was not found!])
++ fail="$fail -Inaaeap.h"
+ fi
+
+ targetname=modname
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c 2012-12-04 19:38:00.241420966 +0100
+@@ -1,12 +1,12 @@
+ /*
+ * eap_tnc.c EAP TNC functionality.
+ *
+- * This software is Copyright (C) 2006,2007 FH Hannover
++ * This software is Copyright (C) 2006-2009 FH Hannover
+ *
+ * Portions of this code unrelated to FreeRADIUS are available
+ * separately under a commercial license. If you require an
+ * implementation of EAP-TNC that is not under the GPLv2, please
+- * contact tnc@inform.fh-hannover.de for details.
++ * contact trust@f4-i.fh-hannover.de for details.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+@@ -23,230 +23,41 @@
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ */
+-#include <freeradius-devel/ident.h>
+-RCSID("$Id$")
+-
+-
+-/*
+- *
+- * MD5 Packet Format in EAP Type-Data
+- * --- ------ ------ -- --- ---------
+- * 0 1 2 3
+- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- * | Value-Size | Value ...
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- * | Name ...
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- *
+- * EAP-TNC Packet Format in EAP Type-Data
+- *
+- * 0 1 2 3
+- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- * | Flags |Ver | Data Length ...
+- * |L M S R R|=1 |
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- * |... | Data ...
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-
+- *
+- */
+-
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include "eap.h"
+
+ #include "eap_tnc.h"
+
+- /*
+- * WTF is wrong with htonl ?
+- */
+-static uint32_t ByteSwap2 (uint32_t nLongNumber)
+-{
+- return (((nLongNumber&0x000000FF)<<24)+((nLongNumber&0x0000FF00)<<8)+
+- ((nLongNumber&0x00FF0000)>>8)+((nLongNumber&0xFF000000)>>24));
+-}
+-
+ /*
+- * Allocate a new TNC_PACKET
++ * Forms an EAP_REQUEST packet from the EAP_TNC specific data.
+ */
+-TNC_PACKET *eaptnc_alloc(void)
++int eaptnc_compose(EAP_HANDLER *handler, TNC_BufferReference request, TNC_UInt32 length, uint8_t code)
+ {
+- TNC_PACKET *rp;
+-
+- if ((rp = malloc(sizeof(TNC_PACKET))) == NULL) {
+- radlog(L_ERR, "rlm_eap_tnc: out of memory");
+- return NULL;
++ // check parameters
++ if(handler == NULL || (request == NULL && length != 0) || (request != NULL && length < 1) || code > PW_EAP_MAX_CODES){
++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler == %p, request == %p, length == %lu, code == %u", handler, request, length, code);
++ return 0;
+ }
+- memset(rp, 0, sizeof(TNC_PACKET));
+- return rp;
+-}
+-
+-/*
+- * Free TNC_PACKET
+- */
+-void eaptnc_free(TNC_PACKET **tnc_packet_ptr)
+-{
+- TNC_PACKET *tnc_packet;
+-
+- if (!tnc_packet_ptr) return;
+- tnc_packet = *tnc_packet_ptr;
+- if (tnc_packet == NULL) return;
+-
+- if (tnc_packet->data) free(tnc_packet->data);
+
+- free(tnc_packet);
+-
+- *tnc_packet_ptr = NULL;
+-}
+-
+-/*
+- * We expect only RESPONSE for which REQUEST, SUCCESS or FAILURE is sent back
+- */
+-TNC_PACKET *eaptnc_extract(EAP_DS *eap_ds)
+-{
+- tnc_packet_t *data;
+- TNC_PACKET *packet;
+- /*
+- * We need a response, of type EAP-TNC
+- */
+- if (!eap_ds ||
+- !eap_ds->response ||
+- (eap_ds->response->code != PW_TNC_RESPONSE) ||
+- eap_ds->response->type.type != PW_EAP_TNC ||
+- !eap_ds->response->type.data ||
+- (eap_ds->response->length <= TNC_HEADER_LEN) ||
+- (eap_ds->response->type.data[0] <= 0)) {
+- radlog(L_ERR, "rlm_eap_tnc: corrupted data");
+- return NULL;
++ // further check parameters
++ if(handler->opaque == NULL || handler->eap_ds == NULL){
++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler->opaque == %p, handler->eap_ds == %p", handler->opaque, handler->eap_ds);
++ return 0;
+ }
+- packet = eaptnc_alloc();
+- if (!packet) return NULL;
+-
+
+- packet->code = eap_ds->response->code;
+- packet->id = eap_ds->response->id;
+- packet->length = eap_ds->response->length;
+-
+- data = (tnc_packet_t *)eap_ds->response->type.data;
+- /*
+- * Already checked the size above.
+- */
+- packet->flags_ver = data->flags_ver;
+- unsigned char *ptr = (unsigned char*)data;
+-
+-
+- DEBUG2("Flags/Ver: %x\n", packet->flags_ver);
+- int thisDataLength;
+- int dataStart;
+- if(TNC_LENGTH_INCLUDED(packet->flags_ver)){
+- DEBUG2("data_length included\n");
+-// memcpy(&packet->flags_ver[1], &data->flags_ver[1], 4);
+- //packet->data_length = data->data_length;
+- memcpy(&packet->data_length, &ptr[1], TNC_DATA_LENGTH_LENGTH);
+- DEBUG2("data_length: %x\n", packet->data_length);
+- DEBUG2("data_length: %d\n", packet->data_length);
+- DEBUG2("data_length: %x\n", ByteSwap2(packet->data_length));
+- DEBUG2("data_length: %d\n", ByteSwap2(packet->data_length));
+- packet->data_length = ByteSwap2(packet->data_length);
+- thisDataLength = packet->length-TNC_PACKET_LENGTH; //1: we need space for flags_ver
+- dataStart = TNC_DATA_LENGTH_LENGTH+TNC_FLAGS_VERSION_LENGTH;
+- }else{
+- DEBUG2("no data_length included\n");
+- thisDataLength = packet->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH;
+- packet->data_length = 0;
+- dataStart = TNC_FLAGS_VERSION_LENGTH;
+-
+- }
+- /*
+- * Allocate room for the data, and copy over the data.
+- */
+- packet->data = malloc(thisDataLength);
+- if (packet->data == NULL) {
+- radlog(L_ERR, "rlm_eap_tnc: out of memory");
+- eaptnc_free(&packet);
+- return NULL;
++ if(handler->eap_ds->request == NULL){
++ radlog(L_ERR, "rlm_eap_tnc: eaptnc_compose invalid parameters: handler->eap_ds->request == %p", handler->eap_ds->request);
++ return 0;
+ }
+-
+- memcpy(packet->data, &(eap_ds->response->type.data[dataStart]), thisDataLength);
+-
+- return packet;
+-}
+
+-
+-/*
+- * Compose the portions of the reply packet specific to the
+- * EAP-TNC protocol, in the EAP reply typedata
+- */
+-int eaptnc_compose(EAP_DS *eap_ds, TNC_PACKET *reply)
+-{
+- uint8_t *ptr;
+-
+-
+- if (reply->code < 3) {
+- //fill: EAP-Type (0x888e)
+- eap_ds->request->type.type = PW_EAP_TNC;
+- DEBUG2("TYPE: EAP-TNC set\n");
+- rad_assert(reply->length > 0);
+-
+- //alloc enough space for whole TNC-Packet (from Code on)
+- eap_ds->request->type.data = calloc(reply->length, sizeof(unsigned char*));
+- DEBUG2("Malloc %d bytes for packet\n", reply->length);
+- if (eap_ds->request->type.data == NULL) {
+- radlog(L_ERR, "rlm_eap_tnc: out of memory");
+- return 0;
+- }
+- //put pointer at position where data starts (behind Type)
+- ptr = eap_ds->request->type.data;
+- //*ptr = (uint8_t)(reply->data_length & 0xFF);
+-
+- //ptr++;
+- *ptr = reply->flags_ver;
+- DEBUG2("Set Flags/Version: %d\n", *ptr);
+- if(reply->data_length!=0){
+- DEBUG2("Set data-length: %d\n", reply->data_length);
+- ptr++; //move to start-position of "data_length"
+- DEBUG2("Set data-length: %x\n", reply->data_length);
+- DEBUG2("Set data-length (swapped): %x\n", ByteSwap2(reply->data_length));
+- unsigned long swappedDataLength = ByteSwap2(reply->data_length);
+- //DEBUG2("DATA-length: %d", reply->data_
+- memcpy(ptr, &swappedDataLength, 4);
+- //*ptr = swappedDataLength;
+- }
+- uint16_t thisDataLength=0;
+- if(reply->data!=NULL){
+- DEBUG2("Adding TNCCS-Data ");
+- int offset;
+- //if data_length-Field present
+- if(reply->data_length !=0){
+- DEBUG2("with Fragmentation\n");
+- offset = TNC_DATA_LENGTH_LENGTH; //length of data_length-field: 4
+- thisDataLength = reply->length-TNC_PACKET_LENGTH;
+- }else{ //data_length-Field not present
+- DEBUG2("without Fragmentation\n");
+- offset = 1;
+- thisDataLength = reply->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH;
+- }
+- DEBUG2("TNCCS-Datalength: %d\n", thisDataLength);
+- ptr=ptr+offset; //move to start-position of "data"
+- memcpy(ptr,reply->data, thisDataLength);
+- }else{
+- DEBUG2("No TNCCS-Data present");
+- }
+-
+- //the length of the TNC-packet (behind Type)
+- if(reply->data_length!=0){
+- eap_ds->request->type.length = TNC_DATA_LENGTH_LENGTH+TNC_FLAGS_VERSION_LENGTH+thisDataLength; //4:data_length, 1: flags_ver
+- }else{
+- eap_ds->request->type.length = TNC_FLAGS_VERSION_LENGTH+thisDataLength; //1: flags_ver
+- }
+- DEBUG2("Packet built\n");
+-
+- } else {
+- eap_ds->request->type.length = 0;
+- }
+- eap_ds->request->code = reply->code;
++ // fill EAP data to handler
++ handler->eap_ds->request->code = code;
++ handler->eap_ds->request->type.type = PW_EAP_TNC;
++ // fill EAP TYPE specific data to handler
++ handler->eap_ds->request->type.length = length;
++ free(handler->eap_ds->request->type.data);
++ handler->eap_ds->request->type.data = request;
+
+ return 1;
+ }
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.h 2012-12-04 19:38:00.241420966 +0100
+@@ -1,10 +1,10 @@
+ /*
+- * This software is Copyright (C) 2006,2007 FH Hannover
++ * This software is Copyright (C) 2006-2009 FH Hannover
+ *
+ * Portions of this code unrelated to FreeRADIUS are available
+ * separately under a commercial license. If you require an
+ * implementation of EAP-TNC that is not under the GPLv2, please
+- * contact tnc@inform.fh-hannover.de for details.
++ * contact trust@f4-i.fh-hannover.de for details.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+@@ -26,105 +26,20 @@
+ #define _EAP_TNC_H
+
+ #include "eap.h"
++#include <naaeap/naaeap.h>
+
+-#define PW_TNC_REQUEST 1
+-#define PW_TNC_RESPONSE 2
+-#define PW_TNC_SUCCESS 3
+-#define PW_TNC_FAILURE 4
+-#define PW_TNC_MAX_CODES 4
+-
+-#define TNC_HEADER_LEN 4
+-#define TNC_CHALLENGE_LEN 16
+-#define TNC_START_LEN 8
+-
+-#define TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH 6
+-#define TNC_PACKET_LENGTH 10
+-#define TNC_DATA_LENGTH_LENGTH 4
+-#define TNC_FLAGS_VERSION_LENGTH 1
+-
+-typedef unsigned int VlanAccessMode;
+-
+-#define VLAN_ISOLATE 97
+-#define VLAN_ACCESS 2
+-/*
+- ****
+- * EAP - MD5 doesnot specify code, id & length but chap specifies them,
+- * for generalization purpose, complete header should be sent
+- * and not just value_size, value and name.
+- * future implementation.
+- *
+- * Huh? What does that mean?
+- */
++#define SET_START(x) ((x) | (0x20))
+
+-/*
++/**
++ * Composes the EAP packet.
+ *
+- * MD5 Packet Format in EAP Type-Data
+- * --- ------ ------ -- --- ---------
+- * 0 1 2 3
+- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- * | Value-Size | Value ...
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- * | Name ...
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- *
+- * EAP-TNC Packet Format in EAP Type-Data
+- *
+- * 0 1 2 3
+- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- * | Flags |Ver | Data Length ...
+- * |L M S R R|=1 |
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+- * |... | Data ...
+- * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-
++ * @param handler The EAP_HANDLER from tnc_initiate() or tnc_authenticate
++ * @param request The EAP_TNC packet received from NAA-TNCS
++ * @param length The length of the EAP_TNC packet received from NAA-TNCS
++ * @param code EAP_CODE for the request
+ *
++ * @return True if operation was successful, otherwise false.
+ */
+-
+-/* eap packet structure */
+-typedef struct tnc_packet_t {
+-/*
+- uint8_t code;
+- uint8_t id;
+- uint16_t length;
+-*/
+- uint8_t flags_ver;
+- uint32_t data_length;
+- uint8_t *data;
+-} tnc_packet_t;
+-
+-typedef struct tnc_packet {
+- uint8_t code;
+- uint8_t id;
+- uint16_t length;
+- uint8_t flags_ver;
+- uint32_t data_length;
+- uint8_t *data;
+-} TNC_PACKET;
+-
+-#define TNC_START(x) (((x) & 0x20) != 0)
+-#define TNC_MORE_FRAGMENTS(x) (((x) & 0x40) != 0)
+-#define TNC_LENGTH_INCLUDED(x) (((x) & 0x80) != 0)
+-#define TNC_RESERVED_EQ_NULL(x) (((x) & 0x10) == 0 && ((x) & 0x8) == 0)
+-#define TNC_VERSION_EQ_ONE(x) (((x) & 0x07) == 1)
+-
+-#define SET_START(x) ((x) | (0x20))
+-#define SET_MORE_FRAGMENTS(x) ((x) | (0x40))
+-#define SET_LENGTH_INCLUDED(x) ((x) | (0x80))
+-
+-
+-/* function declarations here */
+-
+-TNC_PACKET *eaptnc_alloc(void);
+-void eaptnc_free(TNC_PACKET **tnc_packet_ptr);
+-
+-int eaptnc_compose(EAP_DS *auth, TNC_PACKET *reply);
+-TNC_PACKET *eaptnc_extract(EAP_DS *auth);
+-int eaptnc_verify(TNC_PACKET *pkt, VALUE_PAIR* pwd, uint8_t *ch);
+-
+-
+-
+-
++int eaptnc_compose(EAP_HANDLER *handler, TNC_BufferReference request, TNC_UInt32 length, uint8_t code);
+
+ #endif /*_EAP_TNC_H*/
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/Makefile.in 2012-12-04 19:38:49.277421870 +0100
+@@ -3,8 +3,8 @@
+ #
+
+ TARGET = @targetname@
+-SRCS = rlm_eap_tnc.c eap_tnc.c tncs_connect.c
+-HEADERS = eap_tnc.h tncs.h tncs_connect.h ../../eap.h ../../rlm_eap.h
++SRCS = rlm_eap_tnc.c eap_tnc.c
++HEADERS = eap_tnc.h ../../eap.h ../../rlm_eap.h
+ RLM_CFLAGS = -I../.. -I../../libeap $(OPENSSL_INCLUDE) @eap_tnc_cflags@
+ RLM_LIBS = @eap_tnc_ldflags@ ../../libeap/$(LIBPREFIX)freeradius-eap.la $(OPENSSL_LIBS)
+ RLM_INSTALL =
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/rlm_eap_tnc.c 2012-12-04 19:38:00.241420966 +0100
+@@ -1,12 +1,12 @@
+ /*
+ * rlm_eap_tnc.c Handles that are called from eap
+ *
+- * This software is Copyright (C) 2006,2007 FH Hannover
++ * This software is Copyright (C) 2006-2009 FH Hannover
+ *
+ * Portions of this code unrelated to FreeRADIUS are available
+ * separately under a commercial license. If you require an
+ * implementation of EAP-TNC that is not under the GPLv2, please
+- * contact tnc@inform.fh-hannover.de for details.
++ * contact trust@f4-i.fh-hannover.de for details.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+@@ -26,96 +26,262 @@
+ * Copyright (C) 2007 Alan DeKok <aland@deployingradius.com>
+ */
+
+-#include <freeradius-devel/ident.h>
+-RCSID("$Id$")
++/*
++ * EAP-TNC Packet with EAP Header, general structure
++ *
++ * 0 1 2 3
++ * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ * | Code | Identifier | Length |
++ * | | | |
++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ * | Type | Flags | Ver | Data Length |
++ * | |L M S R R| =1 | |
++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ * | Data Length | Data ...
++ * | |
++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ */
+
+ #include <freeradius-devel/autoconf.h>
+
+ #include <stdio.h>
+ #include <stdlib.h>
+
+-#include "tncs_connect.h"
+ #include "eap_tnc.h"
+-#include "tncs.h"
++#include <naaeap/naaeap.h>
+ #include <freeradius-devel/rad_assert.h>
++//#include <freeradius-devel/libradius.h>
+
+-typedef struct rlm_eap_tnc_t {
+- char *vlan_access;
+- char *vlan_isolate;
+- char *tnc_path;
+-} rlm_eap_tnc_t;
++#include <netinet/in.h>
+
+-static int sessionCounter=0;
++/**
++ * Calculates an identifying string based upon nas_port, nas_ip and nas_port_type.
++ * The maximum length of the calculated string is 70 (not including the trailing '\0').
++ *
++ * @return the number of bytes written to out (not including the trailing '\0')
++ */
++static uint32_t calculateConnectionString(RADIUS_PACKET* radius_packet, char *out, size_t outMaxLength)
++{
++ VALUE_PAIR *vp = NULL;
++ uint32_t nas_port = 0;
++ uint32_t nas_ip = 0;
++ uint32_t nas_port_type = 0;
++
++ char out_nas_port[11];
++ char out_nas_ip_byte_0[4];
++ char out_nas_ip_byte_1[4];
++ char out_nas_ip_byte_2[4];
++ char out_nas_ip_byte_3[4];
++ char out_nas_port_type[11];
++
++ // check for NULL
++ if (radius_packet == NULL) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: calculateConnectionString failed. radius_packet == NULL!");
++ return 0;
++ }
++
++ // read NAS port, ip and port type
++ for (vp = radius_packet->vps; vp; vp=vp->next) {
++ switch (vp->attribute) {
++ case PW_NAS_PORT:
++ nas_port = vp->vp_integer;
++ DEBUG("NAS scr port = %u\n", nas_port);
++ break;
++ case PW_NAS_IP_ADDRESS:
++ nas_ip = vp->vp_ipaddr;
++ DEBUG("NAS scr ip = %X\n", ntohl(nas_ip));
++ break;
++ case PW_NAS_PORT_TYPE:
++ nas_port_type = vp->vp_integer;
++ DEBUG("NAS scr port type = %u\n", nas_port_type);
++ break;
++ }
++ }
++
++ snprintf(out_nas_port, 11, "%u", nas_port);
++ snprintf(out_nas_ip_byte_0, 4, "%u", nas_ip & 0xFF);
++ snprintf(out_nas_ip_byte_1, 4, "%u", (nas_ip >> 8) & 0xFF);
++ snprintf(out_nas_ip_byte_2, 4, "%u", (nas_ip >> 16) & 0xFF);
++ snprintf(out_nas_ip_byte_3, 4, "%u", (nas_ip >> 24) & 0xFF);
++ snprintf(out_nas_port_type, 11, "%u", nas_port_type);
++
++ return snprintf(out, outMaxLength, "NAS Port: %s NAS IP: %s.%s.%s.%s NAS_PORT_TYPE: %s", out_nas_port, out_nas_ip_byte_3, out_nas_ip_byte_2, out_nas_ip_byte_1, out_nas_ip_byte_0, out_nas_port_type);
++}
++
++/*
++ * This function is called when the FreeRADIUS attach this module.
++ */
++static int tnc_attach(CONF_SECTION *conf, void **type_data)
++{
++ // initialize NAA-EAP
++ DEBUG2("TNC-ATTACH initializing NAA-EAP");
++ TNC_Result result = initializeDefault();
++ if (result != TNC_RESULT_SUCCESS) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_attach error while calling NAA-EAP initializeDefault()");
++ return -1;
++ }
++ return 0;
++}
++
++/*
++ * This function is called when the FreeRADIUS detach this module.
++ */
++static int tnc_detach(void *args)
++{
++ // terminate NAA-EAP
++ DEBUG2("TNC-TERMINATE terminating NAA-EAP");
++ TNC_Result result = terminate();
++ if (result != TNC_RESULT_SUCCESS) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_attach error while calling NAA-EAP terminate()");
++ return -1;
++ }
++ return 0;
++}
+
+ /*
+- * Initiate the EAP-MD5 session by sending a challenge to the peer.
+- * Initiate the EAP-TNC session by sending a EAP Request witch Start Bit set
+- * and with no data
++ * This function is called when the first EAP_IDENTITY_RESPONSE message
++ * was received.
++ *
++ * Initiates the EPA_TNC session by sending the first EAP_TNC_RESPONSE
++ * to the peer. The packet has the Start-Bit set and contains no data.
++ *
++ * 0 1 2 3
++ * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ * | Code | Identifier | Length |
++ * | | | |
++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ * | Type | Flags | Ver |
++ * | |0 0 1 0 0|0 0 1|
++ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ *
++ * For this package, only 'Identifier' has to be set dynamically. Any
++ * other information is static.
+ */
+ static int tnc_initiate(void *type_data, EAP_HANDLER *handler)
+ {
+- uint8_t flags_ver = 1; //set version to 1
+- rlm_eap_tnc_t *inst = type_data;
+- TNC_PACKET *reply;
++ size_t buflen = 71;
++ size_t ret = 0;
++ char buf[buflen];
++ REQUEST * request = NULL;
++ TNC_Result result;
++ TNC_ConnectionID conID;
++ TNC_BufferReference username;
+
++ // check if we run inside a secure EAP method.
++ // FIXME check concrete outer EAP method
+ if (!handler->request || !handler->request->parent) {
+- DEBUG("rlm_eap_tnc: EAP-TNC can only be run inside of a TLS-based method.");
++ DEBUG2("rlm_eap_tnc: EAP_TNC must only be used as an inner method within a protected tunneled EAP created by an outer EAP method.");
++ request = handler->request;
+ return 0;
++ } else {
++ request = handler->request->parent;
+ }
+
+- /*
+- * FIXME: Update this when the TTLS and PEAP methods can
+- * run EAP-TLC *after* the user has been authenticated.
+- * This likely means moving the phase2 handlers to a
+- * common code base.
+- */
+- if (1) {
+- DEBUG("rlm-eap_tnc: EAP-TNC can only be run after the user has been authenticated.");
++ if (request->packet == NULL) {
++ DEBUG2("rlm_eap_tnc: ERROR request->packet is NULL.");
+ return 0;
+ }
+
+ DEBUG("tnc_initiate: %ld", handler->timestamp);
+
+- if(connectToTncs(inst->tnc_path)==-1){
+- DEBUG("Could not connect to TNCS");
++ //calculate connectionString
++ ret = calculateConnectionString(request->packet, buf, buflen);
++ if(ret == 0){
++ radlog(L_ERR, "rlm_eap_tnc:tnc_attach: calculating connection String failed.");
++ return 0;
+ }
+
++ DEBUG2("TNC-INITIATE getting connection from NAA-EAP");
++
+ /*
+- * Allocate an EAP-MD5 packet.
++ * get connection
++ * (uses a function from the NAA-EAP-library)
++ * the presence of the library is checked via the configure-script
+ */
+- reply = eaptnc_alloc();
+- if (reply == NULL) {
+- radlog(L_ERR, "rlm_eap_tnc: out of memory");
++ result = getConnection(buf, &conID);
++
++ // check for errors
++ if (result != TNC_RESULT_SUCCESS) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_initiate error while calling NAA-EAP getConnection");
+ return 0;
+ }
+
+ /*
+- * Fill it with data.
++ * tries to get the username from FreeRADIUS;
++ * copied from modules/rlm_eap/types/rlm_eap_ttls/ttls.c
+ */
+- reply->code = PW_TNC_REQUEST;
+- flags_ver = SET_START(flags_ver); //set start-flag
+- DEBUG("$$$$$$$$$$$$$$$$Flags: %d", flags_ver);
+- reply->flags_ver = flags_ver;
+- reply->length = 1+1; /* one byte of flags_ver */
++ VALUE_PAIR *usernameValuePair;
++ usernameValuePair = pairfind(request->packet->vps, PW_USER_NAME);
+
++ VALUE_PAIR *eapMessageValuePair;
++ if (!usernameValuePair) {
++ eapMessageValuePair = pairfind(request->packet->vps, PW_EAP_MESSAGE);
++
++ if (eapMessageValuePair &&
++ (eapMessageValuePair->length >= EAP_HEADER_LEN + 2) &&
++ (eapMessageValuePair->vp_strvalue[0] == PW_EAP_RESPONSE) &&
++ (eapMessageValuePair->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) &&
++ (eapMessageValuePair->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) {
++
++ /*
++ * Create & remember a User-Name
++ */
++ usernameValuePair = pairmake("User-Name", "", T_OP_EQ);
++ rad_assert(usernameValuePair != NULL);
++
++ memcpy(usernameValuePair->vp_strvalue, eapMessageValuePair->vp_strvalue + 5,
++ eapMessageValuePair->length - 5);
++ usernameValuePair->length = eapMessageValuePair->length - 5;
++ usernameValuePair->vp_strvalue[usernameValuePair->length] = 0;
++ }
++ }
++
++ username = malloc(usernameValuePair->length + 1);
++ memcpy(username, usernameValuePair->vp_strvalue, usernameValuePair->length);
++ username[usernameValuePair->length] = '\0';
++
++ RDEBUG("Username for current TNC connection: %s", username);
++
++ /*
++ * stores the username of this connection
++ * (uses a function from the NAA-EAP-library)
++ * the presence of the library is checked via the configure-script
++ */
++ result = storeUsername(conID, username, usernameValuePair->length);
++
++ // check for errors
++ if (result != TNC_RESULT_SUCCESS) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_initiate error while calling NAA-EAP storeUsername");
++ return 0;
++ }
++
++ // set connection ID in FreeRADIUS
++ handler->opaque = malloc(sizeof(TNC_ConnectionID));
++ memcpy(handler->opaque, &conID, sizeof(TNC_ConnectionID));
++
++ // build first EAP TNC request
++ TNC_BufferReference eap_tnc_request = malloc(sizeof(unsigned char));
++ if (eap_tnc_request == NULL) {
++ radlog(L_ERR, "rlm_eap_tnc:tnc_initiate: malloc failed.");
++ return 0;
++ }
++ *eap_tnc_request = SET_START(1);
++ TNC_UInt32 eap_tnc_length = 1;
++ type_data = type_data; /* suppress -Wunused */
+
+ /*
+ * Compose the EAP-TNC packet out of the data structure,
+ * and free it.
+ */
+- eaptnc_compose(handler->eap_ds, reply);
+- eaptnc_free(&reply);
++ eaptnc_compose(handler, eap_tnc_request, eap_tnc_length, PW_EAP_REQUEST);
+
+- //put sessionAttribute to Handler and increase sessionCounter
+- handler->opaque = calloc(sizeof(TNC_ConnectionID), 1);
+- if (handler->opaque == NULL) {
+- radlog(L_ERR, "rlm_eap_tnc: out of memory");
+- return 0;
+- }
+- handler->free_opaque = free;
+- memcpy(handler->opaque, &sessionCounter, sizeof(int));
+- sessionCounter++;
+-
+ /*
+ * We don't need to authorize the user at this point.
+ *
+@@ -124,246 +290,114 @@
+ * to us...
+ */
+ handler->stage = AUTHENTICATE;
+-
+- return 1;
+-}
+
+-static void setVlanAttribute(rlm_eap_tnc_t *inst, EAP_HANDLER *handler,
+- VlanAccessMode mode){
+- VALUE_PAIR *vp;
+- char *vlanNumber = NULL;
+- switch(mode){
+- case VLAN_ISOLATE:
+- vlanNumber = inst->vlan_isolate;
+- vp = pairfind(handler->request->config_items,
+- PW_TNC_VLAN_ISOLATE);
+- if (vp) vlanNumber = vp->vp_strvalue;
+- break;
+- case VLAN_ACCESS:
+- vlanNumber = inst->vlan_access;
+- vp = pairfind(handler->request->config_items,
+- PW_TNC_VLAN_ACCESS);
+- if (vp) vlanNumber = vp->vp_strvalue;
+- break;
+-
+- default:
+- DEBUG2(" rlm_eap_tnc: Internal error. Not setting vlan number");
+- return;
+- }
+- pairadd(&handler->request->reply->vps,
+- pairmake("Tunnel-Type", "VLAN", T_OP_SET));
+-
+- pairadd(&handler->request->reply->vps,
+- pairmake("Tunnel-Medium-Type", "IEEE-802", T_OP_SET));
+-
+- pairadd(&handler->request->reply->vps,
+- pairmake("Tunnel-Private-Group-ID", vlanNumber, T_OP_SET));
+-
++ return 1;
+ }
+
+-/*
+- * Authenticate a previously sent challenge.
++/**
++ * This function is called when a EAP_TNC_RESPONSE was received.
++ * It basically forwards the EAP_TNC data to NAA-TNCS and forms
++ * and appropriate EAP_RESPONSE. Furthermore, it sets the VlanID
++ * based on the TNC_ConnectionState determined by NAA-TNCS.
++ *
++ * @param type_arg The configuration data
++ * @param handler The EAP_HANDLER
++ * @return True, if successfully, else false.
+ */
+-static int tnc_authenticate(void *type_arg, EAP_HANDLER *handler)
+-{
+- TNC_PACKET *packet;
+- TNC_PACKET *reply;
+- TNC_ConnectionID connId = *((TNC_ConnectionID *) (handler->opaque));
+- TNC_ConnectionState state;
+- rlm_eap_tnc_t *inst = type_arg;
+- int isAcknowledgement = 0;
+- TNC_UInt32 tnccsMsgLength = 0;
+- int isLengthIncluded;
+- int moreFragments;
+- TNC_UInt32 overallLength;
+- TNC_BufferReference outMessage;
+- TNC_UInt32 outMessageLength = 2;
+- int outIsLengthIncluded=0;
+- int outMoreFragments=0;
+- TNC_UInt32 outOverallLength=0;
++static int tnc_authenticate(void *type_arg, EAP_HANDLER *handler) {
+
+- DEBUG2("HANDLER_OPAQUE: %d", (int) *((TNC_ConnectionID *) (handler->opaque)));
+- DEBUG2("TNC-AUTHENTICATE is starting now for %d..........", (int) connId);
++ rad_assert(handler->request != NULL); // check that request has been sent previously
++ rad_assert(handler->stage == AUTHENTICATE); // check if initiate has been called
+
+- /*
+- * Get the User-Password for this user.
+- */
+- rad_assert(handler->request != NULL);
+- rad_assert(handler->stage == AUTHENTICATE);
+-
+- /*
+- * Extract the EAP-TNC packet.
+- */
+- if (!(packet = eaptnc_extract(handler->eap_ds)))
++ if (handler == NULL) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler == NULL");
+ return 0;
++ }
++ if (handler->eap_ds == NULL) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds == NULL");
++ return 0;
++ }
++ if (handler->eap_ds->response == NULL) {
++ radlog(
++ L_ERR,
++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds->resonse == NULL");
++ return 0;
++ }
++ if (handler->eap_ds->response->type.type != PW_EAP_TNC
++ || handler->eap_ds->response->type.length < 1
++ || handler->eap_ds->response->type.data == NULL) {
++ radlog(
++ L_ERR,
++ "rlm_eap_tnc: tnc_authenticate invalid parameters: handler->eap_ds->response->type.type == %X, ->type.length == %u, ->type.data == %p",
++ handler->eap_ds->response->type.type,
++ handler->eap_ds->response->type.length,
++ handler->eap_ds->response->type.data);
++ return 0;
++ }
+
+- /*
+- * Create a reply, and initialize it.
+- */
+- reply = eaptnc_alloc();
+- if (!reply) {
+- eaptnc_free(&packet);
+- return 0;
+- }
+-
+- reply->id = handler->eap_ds->request->id;
+- reply->length = 0;
+- if(packet->data_length==0){
+- tnccsMsgLength = packet->length-TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH;
+- }else{
+- tnccsMsgLength = packet->length-TNC_PACKET_LENGTH;
+- }
+- isLengthIncluded = TNC_LENGTH_INCLUDED(packet->flags_ver);
+- moreFragments = TNC_MORE_FRAGMENTS(packet->flags_ver);
+- overallLength = packet->data_length;
+- if(isLengthIncluded == 0
+- && moreFragments == 0
+- && overallLength == 0
+- && tnccsMsgLength == 0
+- && TNC_START(packet->flags_ver)==0){
+-
+- isAcknowledgement = 1;
+- }
+-
+- DEBUG("Data received: (%d)", (int) tnccsMsgLength);
+-/* int i;
+- for(i=0;i<tnccsMsgLength;i++){
+- DEBUG2("%c", (packet->data)[i]);
+- }
+- DEBUG2("\n");
+- */
+- state = exchangeTNCCSMessages(inst->tnc_path,
+- connId,
+- isAcknowledgement,
+- packet->data,
+- tnccsMsgLength,
+- isLengthIncluded,
+- moreFragments,
+- overallLength,
+- &outMessage,
+- &outMessageLength,
+- &outIsLengthIncluded,
+- &outMoreFragments,
+- &outOverallLength);
+- DEBUG("GOT State %08x from TNCS", (unsigned int) state);
+- if(state == TNC_CONNECTION_EAP_ACKNOWLEDGEMENT){ //send back acknoledgement
+- reply->code = PW_TNC_REQUEST;
+- reply->data = NULL;
+- reply->data_length = 0;
+- reply->flags_ver = 1;
+- reply->length =TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH;
+- }else{ //send back normal message
+- DEBUG("GOT Message from TNCS (length: %d)", (int) outMessageLength);
+-
+- /* for(i=0;i<outMessageLength;i++){
+- DEBUG2("%c", outMessage[i]);
+- }
+- DEBUG2("\n");
+- */
+- DEBUG("outIsLengthIncluded: %d, outMoreFragments: %d, outOverallLength: %d",
+- outIsLengthIncluded, outMoreFragments, (int) outOverallLength);
+- DEBUG("NEW STATE: %08x", (unsigned int) state);
+- switch(state){
+- case TNC_CONNECTION_STATE_HANDSHAKE:
+- reply->code = PW_TNC_REQUEST;
+- DEBUG2("Set Reply->Code to EAP-REQUEST\n");
+- break;
+- case TNC_CONNECTION_STATE_ACCESS_ALLOWED:
+- reply->code = PW_TNC_SUCCESS;
+- setVlanAttribute(inst, handler,VLAN_ACCESS);
+- break;
+- case TNC_CONNECTION_STATE_ACCESS_NONE:
+- reply->code = PW_TNC_FAILURE;
+- //setVlanAttribute(inst, handler, VLAN_ISOLATE);
+- break;
+- case TNC_CONNECTION_STATE_ACCESS_ISOLATED:
+- reply->code = PW_TNC_SUCCESS;
+- setVlanAttribute(inst, handler, VLAN_ISOLATE);
+- break;
+- default:
+- reply->code= PW_TNC_FAILURE;
+-
+- }
+- if(outMessage!=NULL && outMessageLength!=0){
+- reply->data = outMessage;
+- }
+- reply->flags_ver = 1;
+- if(outIsLengthIncluded){
+- reply->flags_ver = SET_LENGTH_INCLUDED(reply->flags_ver);
+- reply->data_length = outOverallLength;
+- reply->length = TNC_PACKET_LENGTH + outMessageLength;
+- DEBUG("SET LENGTH: %d", reply->length);
+- DEBUG("SET DATALENGTH: %d", (int) outOverallLength);
+- }else{
+- reply->data_length = 0;
+- reply->length = TNC_PACKET_LENGTH_WITHOUT_DATA_LENGTH + outMessageLength;
+- DEBUG("SET LENGTH: %d", reply->length);
+- }
+- if(outMoreFragments){
+- reply->flags_ver = SET_MORE_FRAGMENTS(reply->flags_ver);
+- }
+- }
+-
+- /*
+- * Compose the EAP-MD5 packet out of the data structure,
+- * and free it.
+- */
+- eaptnc_compose(handler->eap_ds, reply);
+- eaptnc_free(&reply);
+-
+- handler->stage = AUTHENTICATE;
+-
+- eaptnc_free(&packet);
+- return 1;
+-}
+-
+-/*
+- * Detach the EAP-TNC module.
+- */
+-static int tnc_detach(void *arg)
+-{
+- free(arg);
+- return 0;
+-}
+-
+-
+-static CONF_PARSER module_config[] = {
+- { "vlan_access", PW_TYPE_STRING_PTR,
+- offsetof(rlm_eap_tnc_t, vlan_access), NULL, NULL },
+- { "vlan_isolate", PW_TYPE_STRING_PTR,
+- offsetof(rlm_eap_tnc_t, vlan_isolate), NULL, NULL },
+- { "tnc_path", PW_TYPE_STRING_PTR,
+- offsetof(rlm_eap_tnc_t, tnc_path), NULL,
+- "/usr/local/lib/libTNCS.so"},
++ // get connection ID
++ TNC_ConnectionID conID = *((TNC_ConnectionID *) (handler->opaque));
+
+- { NULL, -1, 0, NULL, NULL } /* end the list */
+-};
++ DEBUG2("TNC-AUTHENTICATE is starting now for connection ID %lX !", conID);
+
+-/*
+- * Attach the EAP-TNC module.
+- */
+-static int tnc_attach(CONF_SECTION *cs, void **instance)
+-{
+- rlm_eap_tnc_t *inst;
++ // pass EAP_TNC data to NAA-EAP and get answer data
++ TNC_BufferReference output = NULL;
++ TNC_UInt32 outputLength = 0;
++ TNC_ConnectionState connectionState = TNC_CONNECTION_STATE_CREATE;
+
+- inst = malloc(sizeof(*inst));
+- if (!inst) return -1;
+- memset(inst, 0, sizeof(*inst));
++ /*
++ * forwards the eap_tnc data to NAA-EAP and gets the response
++ * (uses a function from the NAA-EAP-library)
++ * the presence of the library is checked via the configure-script
++ */
++ TNC_Result result = processEAPTNCData(conID, handler->eap_ds->response->type.data,
++ handler->eap_ds->response->type.length, &output, &outputLength,
++ &connectionState);
++
++ // check for errors
++ if (result != TNC_RESULT_SUCCESS) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_authenticate error while calling NAA-EAP processEAPTNCData");
++ return 0;
++ }
+
+- if (cf_section_parse(cs, inst, module_config) < 0) {
+- tnc_detach(inst);
+- return -1;
++ // output contains now the answer from NAA-EAP
++ uint8_t eapCode = 0;
++ // determine eapCode for request
++ switch (connectionState) {
++ case TNC_CONNECTION_STATE_HANDSHAKE:
++ eapCode = PW_EAP_REQUEST;
++ break;
++ case TNC_CONNECTION_STATE_ACCESS_NONE:
++ eapCode = PW_EAP_FAILURE;
++ break;
++ case TNC_CONNECTION_STATE_ACCESS_ALLOWED:
++ eapCode = PW_EAP_SUCCESS;
++ pairadd(&handler->request->config_items, pairmake("TNC-Status", "Access", T_OP_SET));
++ break;
++ case TNC_CONNECTION_STATE_ACCESS_ISOLATED:
++ eapCode = PW_EAP_SUCCESS;
++ pairadd(&handler->request->config_items, pairmake("TNC-Status", "Isolate", T_OP_SET));
++ break;
++ default:
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_authenticate invalid TNC_CONNECTION_STATE.");
++ return 0;
+ }
+
+-
+- if (!inst->vlan_access || !inst->vlan_isolate) {
+- radlog(L_ERR, "rlm_eap_tnc: Must set both vlan_access and vlan_isolate");
+- tnc_detach(inst);
+- return -1;
++ // form EAP_REQUEST
++ if (!eaptnc_compose(handler, output, outputLength, eapCode)) {
++ radlog(L_ERR,
++ "rlm_eap_tnc: tnc_authenticate error while forming EAP_REQUEST.");
++ return 0;
+ }
+
+- *instance = inst;
+- return 0;
++ // FIXME: Why is that needed?
++ handler->stage = AUTHENTICATE;
++
++ return 1;
+ }
+
+ /*
+@@ -371,10 +405,10 @@
+ * That is, everything else should be 'static'.
+ */
+ EAP_TYPE rlm_eap_tnc = {
+- "eap_tnc",
+- tnc_attach, /* attach */
+- tnc_initiate, /* Start the initial request */
+- NULL, /* authorization */
+- tnc_authenticate, /* authentication */
+- tnc_detach /* detach */
++ "eap_tnc",
++ tnc_attach, /* attach */
++ tnc_initiate, /* Start the initial request */
++ NULL, /* authorization */
++ tnc_authenticate, /* authentication */
++ tnc_detach /* detach */
+ };
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.c 1970-01-01 01:00:00.000000000 +0100
+@@ -1,146 +0,0 @@
+-/*
+- * This software is Copyright (C) 2006,2007 FH Hannover
+- *
+- * Portions of this code unrelated to FreeRADIUS are available
+- * separately under a commercial license. If you require an
+- * implementation of EAP-TNC that is not under the GPLv2, please
+- * contact tnc@inform.fh-hannover.de for details.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, write to the Free Software
+- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+- *
+- */
+-#include <freeradius-devel/ident.h>
+-RCSID("$Id$")
+-
+-#include "tncs_connect.h"
+-#include <ltdl.h>
+-#include <stdlib.h>
+-#include <stdio.h>
+-#include <eap.h>
+-
+- /*
+- * FIXME: This linking should really be done at compile time.
+- */
+-static lt_dlhandle handle = NULL;
+-
+-static ExchangeTNCCSMessagePointer callTNCS = NULL;
+-
+-/*
+- * returns the function-pointer to a function of a shared-object
+- *
+- * soHandle: handle to a shared-object
+- * name: name of the requested function
+- *
+- * return: the procAddress if found, else NULL
+- */
+-static void *getProcAddress(lt_dlhandle soHandle, const char *name){
+- void *proc = lt_dlsym(soHandle, name);
+- DEBUG("Searching for function %s", name);
+- if(proc == NULL){
+- DEBUG("rlm_eap_tnc: Failed to resolve symbol %s: %s",
+- name, lt_dlerror());
+- }
+- return proc;
+-}
+-
+-
+-/*
+- * establishs the connection to the TNCCS without calling functionality.
+- * That means that the TNCS-shared-object is loaded and the function-pointer
+- * to "exchangeTNCCSMessages" is explored.
+- *
+- * return: -1 if connect failed, 0 if connect was successful
+- */
+-int connectToTncs(char *pathToSO){
+- int state = -1;
+- if(handle==NULL){
+- handle = lt_dlopen(pathToSO);
+- DEBUG("OPENED HANDLE!");
+- }
+-
+- if(handle==NULL){
+- DEBUG("HANDLE IS NULL");
+- DEBUG("rlm_eap_tnc: Failed to link to library %s: %s",
+- pathToSO, lt_dlerror());
+- }else{
+- DEBUG("SO %s found!", pathToSO);
+- if(callTNCS==NULL){
+- callTNCS = (ExchangeTNCCSMessagePointer) getProcAddress(handle, "exchangeTNCCSMessages");
+- }
+- if(callTNCS!=NULL){
+- DEBUG("TNCS is connected");
+- state = 0;
+-// int ret = callTNCS2(2, "Bla", NULL);
+- // DEBUG("GOT %d from exchangeTNCCSMessages", ret);
+- }else{
+- DEBUG("Could not find exchangeTNCCSMessages");
+- }
+-
+- }
+- return state;
+-}
+-
+-/*
+- * Accesspoint to the TNCS for sending and receiving TNCCS-Messages.
+- * -pathToSO: Path to TNCCS-Shared Object
+- * -connId: identifies the client which the passed message belongs to.
+- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant
+- * -input: input-TNCCS-message received from the client with connId
+- * -inputLength: length of input-TNCCS-message
+- * -isFirst: 1 if first message in fragmentation else 0
+- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)?
+- * -overallLength: length of all fragments together (only set if fragmentation)
+- * -output: answer-TNCCS-message from the TNCS to the client
+- * -outputLength: length of answer-TNCCS-message
+- * -answerIsFirst: returned answer is first in row
+- * -moreFragmentsFollow: more fragments after this answer
+- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer
+- *
+- * return: state of connection as result of the exchange
+- */
+-TNC_ConnectionState exchangeTNCCSMessages(/*in*/ char *pathToSO,
+- /*in*/ TNC_ConnectionID connId,
+- /*in*/ int isAcknoledgement,
+- /*in*/ TNC_BufferReference input,
+- /*in*/ TNC_UInt32 inputLength,
+- /*in*/ int isFirst,
+- /*in*/ int moreFragments,
+- /*in*/ TNC_UInt32 overallLength,
+- /*out*/ TNC_BufferReference *output,
+- /*out*/ TNC_UInt32 *outputLength,
+- /*out*/ int *answerIsFirst,
+- /*out*/ int *moreFragmentsFollow,
+- /*out*/ TNC_UInt32 *overallLengthOut){
+- TNC_ConnectionState state = TNC_CONNECTION_STATE_ACCESS_NONE;
+- int connectStatus = connectToTncs(pathToSO);
+- if(connectStatus!=-1){
+- state = callTNCS(connId,
+- isAcknoledgement,
+- input,
+- inputLength,
+- isFirst,
+- moreFragments,
+- overallLength,
+- output,
+- outputLength,
+- answerIsFirst,
+- moreFragmentsFollow,
+- overallLengthOut);
+- DEBUG("GOT TNC_ConnectionState (juhuuu): %u", (unsigned int) state);
+- }else{
+- DEBUG("CAN NOT CONNECT TO TNCS");
+- }
+- return state;
+-}
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs_connect.h 1970-01-01 01:00:00.000000000 +0100
+@@ -1,70 +0,0 @@
+-/*
+- * This software is Copyright (C) 2006,2007 FH Hannover
+- *
+- * Portions of this code unrelated to FreeRADIUS are available
+- * separately under a commercial license. If you require an
+- * implementation of EAP-TNC that is not under the GPLv2, please
+- * contact tnc@inform.fh-hannover.de for details.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, write to the Free Software
+- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+- *
+- */
+-
+-#ifndef _TNCS_CONNECT_H_
+-#define _TNCS_CONNECT_H_
+-
+-#include "tncs.h"
+-
+-/*
+- * establishs the connection to the TNCCS without calling functionality.
+- * That means that the TNCS-shared-object is loaded and the function-pointer
+- * to "exchangeTNCCSMessages" is explored.
+- *
+- * return: -1 if connect failed, 0 if connect was successful
+- */
+-int connectToTncs(char *pathToSO);
+-/*
+- * Accesspoint to the TNCS for sending and receiving TNCCS-Messages.
+- * -pathToSO: Path to TNCCS-Shared Object
+- * -connId: identifies the client which the passed message belongs to.
+- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant
+- * -input: input-TNCCS-message received from the client with connId
+- * -inputLength: length of input-TNCCS-message
+- * -isFirst: 1 if first message in fragmentation else 0
+- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)?
+- * -overallLength: length of all fragments together (only set if fragmentation)
+- * -output: answer-TNCCS-message from the TNCS to the client
+- * -outputLength: length of answer-TNCCS-message
+- * -answerIsFirst: returned answer is first in row
+- * -moreFragmentsFollow: more fragments after this answer
+- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer
+- *
+- * return: state of connection as result of the exchange
+- */
+-TNC_ConnectionState exchangeTNCCSMessages(/*in*/ char *pathToSO,
+- /*in*/ TNC_ConnectionID connId,
+- /*in*/ int isAcknoledgement,
+- /*in*/ TNC_BufferReference input,
+- /*in*/ TNC_UInt32 inputLength,
+- /*in*/ int isFirst,
+- /*in*/ int moreFragments,
+- /*in*/ TNC_UInt32 overallLength,
+- /*out*/ TNC_BufferReference *output,
+- /*out*/ TNC_UInt32 *outputLength,
+- /*out*/ int *answerIsFirst,
+- /*out*/ int *moreFragmentsFollow,
+- /*out*/ TNC_UInt32 *overallLengthOut);
+-
+-#endif //_TNCS_CONNECT_H_
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_tnc/tncs.h 1970-01-01 01:00:00.000000000 +0100
+@@ -1,86 +0,0 @@
+-/*
+- * This software is Copyright (C) 2006,2007 FH Hannover
+- *
+- * Portions of this code unrelated to FreeRADIUS are available
+- * separately under a commercial license. If you require an
+- * implementation of EAP-TNC that is not under the GPLv2, please
+- * contact tnc@inform.fh-hannover.de for details.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, write to the Free Software
+- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+- *
+- */
+-
+-#ifndef _TNCS_H_
+-#define _TNCS_H_
+-
+-
+-
+-#ifdef __cplusplus
+-extern "C" {
+-#endif
+-
+-/*
+- * copied from tncimv.h:
+- */
+-typedef unsigned long TNC_UInt32;
+-typedef TNC_UInt32 TNC_ConnectionState;
+-typedef unsigned char *TNC_BufferReference;
+-typedef TNC_UInt32 TNC_ConnectionID;
+-
+-#define TNC_CONNECTION_STATE_CREATE 0
+-#define TNC_CONNECTION_STATE_HANDSHAKE 1
+-#define TNC_CONNECTION_STATE_ACCESS_ALLOWED 2
+-#define TNC_CONNECTION_STATE_ACCESS_ISOLATED 3
+-#define TNC_CONNECTION_STATE_ACCESS_NONE 4
+-#define TNC_CONNECTION_STATE_DELETE 5
+-#define TNC_CONNECTION_EAP_ACKNOWLEDGEMENT 6
+-
+-/*
+- * Accesspoint (as function-pointer) to the TNCS for sending and receiving
+- * TNCCS-Messages.
+- *
+- * -connId: identifies the client which the passed message belongs to.
+- * -isAcknoledgement: 1 if acknoledgement received (then all following in-parameters unimportant
+- * -input: input-TNCCS-message received from the client with connId
+- * -inputLength: length of input-TNCCS-message
+- * -isFirst: 1 if first message in fragmentation else 0
+- * -moreFragments: are there more Fragments to come (yes: 1, no: 0)?
+- * -overallLength: length of all fragments together (only set if fragmentation)
+- * -output: answer-TNCCS-message from the TNCS to the client
+- * -outputLength: length of answer-TNCCS-message
+- * -answerIsFirst: returned answer is first in row
+- * -moreFragmentsFollow: more fragments after this answer
+- * -overallLengthOut: length of all fragments together (only set if fragmentation) as answer
+- *
+- * return: state of connection as result of the exchange
+- */
+-typedef TNC_ConnectionState (*ExchangeTNCCSMessagePointer)(/*in*/ TNC_ConnectionID connId,
+- /*in*/ int isAcknoledgement,
+- /*in*/ TNC_BufferReference input,
+- /*in*/ TNC_UInt32 inputLength,
+- /*in*/ int isFirst,
+- /*in*/ int moreFragments,
+- /*in*/ TNC_UInt32 overallLength,
+- /*out*/ TNC_BufferReference *output,
+- /*out*/ TNC_UInt32 *outputLength,
+- /*out*/ int *answerIsFirst,
+- /*out*/ int *moreFragmentsFollow,
+- /*out*/ TNC_UInt32 *overallLengthOut
+-);
+-
+-#ifdef __cplusplus
+-}
+-#endif
+-#endif //_TNCS_H_
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h 2012-12-04 19:39:54.749423138 +0100
+@@ -37,6 +37,10 @@
+ int copy_request_to_tunnel;
+ int use_tunneled_reply;
+ const char *virtual_server;
++ const char *tnc_virtual_server; // virtual server for EAP-TNC as the second inner method
++ VALUE_PAIR *auth_reply; // cache storage of the last reply of the first inner method
++ int auth_code; // cache storage of the reply-code of the first inner method
++ int doing_tnc; // status if we're doing EAP-TNC
+ } ttls_tunnel_t;
+
+ /*
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c 2012-12-04 19:39:54.749423138 +0100
+@@ -62,6 +62,11 @@
+ * Virtual server for inner tunnel session.
+ */
+ char *virtual_server;
++
++ /*
++ * Virtual server for the second inner tunnel method, which is EAP-TNC.
++ */
++ char *tnc_virtual_server;
+ } rlm_eap_ttls_t;
+
+
+@@ -78,6 +83,9 @@
+ { "virtual_server", PW_TYPE_STRING_PTR,
+ offsetof(rlm_eap_ttls_t, virtual_server), NULL, NULL },
+
++ { "tnc_virtual_server", PW_TYPE_STRING_PTR,
++ offsetof(rlm_eap_ttls_t, tnc_virtual_server), NULL, NULL },
++
+ { "include_length", PW_TYPE_BOOLEAN,
+ offsetof(rlm_eap_ttls_t, include_length), NULL, "yes" },
+
+@@ -171,6 +179,10 @@
+ t->copy_request_to_tunnel = inst->copy_request_to_tunnel;
+ t->use_tunneled_reply = inst->use_tunneled_reply;
+ t->virtual_server = inst->virtual_server;
++ t->tnc_virtual_server = inst->tnc_virtual_server; // virtual server for EAP-TNC as the second inner method
++ t->auth_reply = NULL; // cache storage of the last reply of the first inner method
++ t->auth_code = -1; // cache storage of the reply-code of the first inner method
++ t->doing_tnc = 0; // status if we're doing EAP-TNC (on start we're doing NOT)
+ return t;
+ }
+
+diff -u -r -N freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
+--- freeradius-server-2.2.0.orig/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c 2012-09-10 13:51:34.000000000 +0200
++++ freeradius-server-2.2.0/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c 2012-12-04 19:39:54.749423138 +0100
+@@ -585,6 +585,94 @@
+ }
+
+ /*
++ * Start EAP-TNC as a second inner method.
++ * Creates a new fake-request out of the original incoming request (via EAP_HANDLER).
++ * If it's the first time, we create a EAP-START-packet and send
++ * EAP-START := code = PW_EAP_REQUEST
++ *
++ */
++static REQUEST* start_tnc(EAP_HANDLER *handler, ttls_tunnel_t *t) {
++ REQUEST* request = handler->request;
++ RDEBUG2("EAP-TNC as second inner authentication method starts now");
++
++ /*
++ * Allocate a fake REQUEST struct,
++ * to make a new request, based on the original request.
++ */
++ REQUEST* fake = request_alloc_fake(request);
++
++ /*
++ * Set the virtual server to that of EAP-TNC.
++ */
++ fake->server = t->tnc_virtual_server;
++
++ /*
++ * Build a new EAP-Message.
++ */
++ VALUE_PAIR *eap_msg;
++ eap_msg = paircreate(PW_EAP_MESSAGE, PW_TYPE_OCTETS);
++
++ /*
++ * Set the EAP-Message to look like EAP-Start
++ */
++ eap_msg->vp_octets[0] = PW_EAP_RESPONSE;
++ eap_msg->vp_octets[1] = 0x00;
++
++ /*
++ * Only setting EAP-TNC here,
++ * because it is intended to do user-authentication in the first inner method,
++ * and then a hardware-authentication (like EAP-TNC) as the second method.
++ */
++ eap_msg->vp_octets[4] = PW_EAP_TNC;
++
++ eap_msg->length = 0;
++
++ /*
++ * Add the EAP-Message to the request.
++ */
++ pairadd(&(fake->packet->vps), eap_msg);
++
++ /*
++ * Process the new request by the virtual server configured for
++ * EAP-TNC.
++ */
++ rad_authenticate(fake);
++
++ /*
++ * From now on we're doing EAP-TNC as the second inner authentication method.
++ */
++ t->doing_tnc = TRUE;
++
++ return fake;
++}
++
++/*
++ * Stop EAP-TNC as a second inner method.
++ * Copy the value pairs from the cached Access-Accept of the first inner method
++ * to the Access-Accept/Reject package of EAP-TNC.
++ */
++static REQUEST* stop_tnc(REQUEST *request, ttls_tunnel_t *t) {
++ RDEBUG2("EAP-TNC as second inner authentication method stops now");
++
++ /*
++ * Copy the value-pairs of the origina Access-Accept of the first
++ * inner authentication method to the Access-Accept/Reject of the
++ * second inner authentication method (EAP-TNC).
++ */
++ if (request->reply->code == PW_AUTHENTICATION_ACK) {
++ pairadd(&(request->reply->vps), t->auth_reply);
++ } else if (request->reply->code == PW_AUTHENTICATION_REJECT) {
++ pairadd(&(request->reply->vps), t->auth_reply);
++ }
++
++ pairdelete(&(request->reply->vps), PW_MESSAGE_AUTHENTICATOR);
++ pairdelete(&(request->reply->vps), PW_PROXY_STATE);
++ pairdelete(&(request->reply->vps), PW_USER_NAME);
++
++ return request;
++}
++
++/*
+ * Use a reply packet to determine what to do.
+ */
+ static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
+@@ -1135,6 +1223,16 @@
+
+ } /* else fake->server == request->server */
+
++ /*
++ * If we're doing EAP-TNC as a second method,
++ * then set the server to that one.
++ * Then, rad_authenticate will run EAP-TNC,
++ * so that afterwards we have to look for the state of
++ * EAP-TNC.
++ */
++ if (t->doing_tnc) {
++ fake->server = t->tnc_virtual_server;
++ }
+
+ if ((debug_flag > 0) && fr_log_fp) {
+ RDEBUG("Sending tunneled request");
+@@ -1248,6 +1346,53 @@
+
+ default:
+ /*
++ * If the result of the first method was an acknowledgment OR
++ * if were already running EAP-TNC,
++ * we're doing additional things before processing the reply.
++ * Also the configuration for EAP-TTLS has to contain a virtual server
++ * for EAP-TNC as the second method.
++ */
++ if (t->tnc_virtual_server) {
++ /*
++ * If the reply code of the first inner method is PW_AUTHENTICATION_ACK
++ * which means that the method was successful,
++ * and we're not doing EAP-TNC as the second method,
++ * then we want to intercept the Access-Accept and start EAP-TNC as the second inner method.
++ */
++ if (fake->reply->code == PW_AUTHENTICATION_ACK
++ && t->doing_tnc == FALSE) {
++ RDEBUG2("Reply-Code of the first inner method was: %d (PW_AUTHENTICATION_ACK)", fake->reply->code);
++
++ /*
++ * Save reply-value pairs and reply-code of the first method.
++ */
++ t->auth_reply = fake->reply->vps;
++ fake->reply->vps = NULL;
++ t->auth_code = fake->reply->code;
++
++ /*
++ * Create the start package for EAP-TNC.
++ */
++ fake = start_tnc(handler, t);
++
++ /*
++ * If we're doing EAP-TNC as the second inner method,
++ * and the reply->code was PW_AUTHENTICATION_ACK or PW_AUTHENTICATION_REJECT,
++ * then we stop EAP-TNC and create an combined Access-Accept or Access-Reject.
++ */
++ } else if (t->doing_tnc == TRUE
++ && (fake->reply->code == PW_AUTHENTICATION_ACK || fake->reply->code == PW_AUTHENTICATION_REJECT)) {
++
++ /*
++ * Create the combined Access-Accept or -Reject.
++ */
++ RDEBUG2("Reply-Code of EAP-TNC as the second inner method was: %d (%s)", fake->reply->code,
++ fake->reply->code == PW_AUTHENTICATION_ACK ? "PW_AUTHENTICATION_ACK" : "PW_AUTHENTICATION_REJECT");
++ fake = stop_tnc(fake, t);
++ }
++ }
++
++ /*
+ * Returns RLM_MODULE_FOO, and we want to return
+ * PW_FOO
+ */
diff --git a/testing/scripts/recipes/patches/iptables-xfrm-hooks b/testing/scripts/recipes/patches/iptables-xfrm-hooks
new file mode 100644
index 000000000..baa4a65c1
--- /dev/null
+++ b/testing/scripts/recipes/patches/iptables-xfrm-hooks
@@ -0,0 +1,61 @@
+From 4553ba0130bb9f0aa266cc1e4c3288a52f34eed6 Mon Sep 17 00:00:00 2001
+From: Martin Willi <martin@revosec.ch>
+Date: Wed, 7 Apr 2010 11:40:15 +0200
+Subject: [PATCH] Added XFRM hooks to iptables headers
+
+---
+ include/linux/netfilter.h | 2 ++
+ include/linux/netfilter_ipv4.h | 6 +++++-
+ include/linux/netfilter_ipv6.h | 6 +++++-
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
+index 2eb00b6..b692c67 100644
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -35,6 +35,8 @@ enum nf_inet_hooks {
+ NF_INET_FORWARD,
+ NF_INET_LOCAL_OUT,
+ NF_INET_POST_ROUTING,
++ NF_INET_XFRM_IN,
++ NF_INET_XFRM_OUT,
+ NF_INET_NUMHOOKS
+ };
+
+diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
+index 4d7ba3e..28d3ca9 100644
+--- a/include/linux/netfilter_ipv4.h
++++ b/include/linux/netfilter_ipv4.h
+@@ -47,7 +47,11 @@
+ #define NF_IP_LOCAL_OUT 3
+ /* Packets about to hit the wire. */
+ #define NF_IP_POST_ROUTING 4
+-#define NF_IP_NUMHOOKS 5
++/* Packets going into XFRM input transformation. */
++#define NF_IP_XFRM_IN 5
++/* Packets going into XFRM output transformation. */
++#define NF_IP_XFRM_OUT 6
++#define NF_IP_NUMHOOKS 7
+
+ enum nf_ip_hook_priorities {
+ NF_IP_PRI_FIRST = INT_MIN,
+diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
+index 7430b39..18590a5 100644
+--- a/include/linux/netfilter_ipv6.h
++++ b/include/linux/netfilter_ipv6.h
+@@ -51,7 +51,11 @@
+ #define NF_IP6_LOCAL_OUT 3
+ /* Packets about to hit the wire. */
+ #define NF_IP6_POST_ROUTING 4
+-#define NF_IP6_NUMHOOKS 5
++/* Packets going into XFRM input transformation. */
++#define NF_IP6_XFRM_IN 5
++/* Packets going into XFRM output transformation. */
++#define NF_IP6_XFRM_OUT 6
++#define NF_IP6_NUMHOOKS 7
+
+
+ enum nf_ip6_hook_priorities {
+--
+1.6.3.3
+
diff --git a/testing/scripts/restore-defaults b/testing/scripts/restore-defaults
index 64cc0262e..953548a1b 100755
--- a/testing/scripts/restore-defaults
+++ b/testing/scripts/restore-defaults
@@ -14,32 +14,20 @@
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-##########################################################################
-# load-testconfig requires a testname as an argument
-#
+DIR=$(dirname `readlink -f $0`)
+. $DIR/../testing.conf
+. $DIR/function.sh
testname=$1
-HOSTCONFIGDIR=$BUILDDIR/hosts
+HOSTCONFIGDIR=$DIR/../hosts
TESTSDIR=$BUILDDIR/tests
[ -d $TESTSDIR ] || die "Directory '$TESTSDIR' not found"
[ -d $TESTSDIR/$testname ] || die "Test '$testname' not found"
[ -f $TESTSDIR/$testname/test.conf ] || die "File 'test.conf' is missing"
-source $TESTSDIR/$testname/test.conf
-
-##########################################################################
-# copy default host config back if necessary
-#
+. $TESTSDIR/$testname/test.conf
if [ -d $TESTSDIR/${testname}/hosts ]
then
@@ -47,5 +35,6 @@ then
do
eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
scp $SSHCONF -r $HOSTCONFIGDIR/${host}/etc $HOSTLOGIN:/ > /dev/null 2>&1
+ scp $SSHCONF -r $HOSTCONFIGDIR/default/etc $HOSTLOGIN:/ > /dev/null 2>&1
done
fi
diff --git a/testing/scripts/shutdown-umls b/testing/scripts/shutdown-umls
deleted file mode 100755
index e71e46602..000000000
--- a/testing/scripts/shutdown-umls
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/bash
-# Install strongSwan from mounted strongswan-shared tree
-#
-# Copyright (C) 2006 Martin Willi
-# Hochschule fuer Technik Rapperswil
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-#
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-cecho "shutting down"
-cecho-n " "
-
-for host in $STRONGSWANHOSTS
-do
- eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
- cecho-n "$host... "
- ssh $HOSTLOGIN 'shutdown now -h' > /dev/null
-done
-
-cecho
diff --git a/testing/scripts/start-bridges b/testing/scripts/start-bridges
deleted file mode 100755
index 1e09d6e7d..000000000
--- a/testing/scripts/start-bridges
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/bin/bash
-# start the UML bridges in the kernel using the brctl command
-#
-# Copyright (C) 2009 Andreas Steffen
-# HSR Hochschule fuer Technik Rapperswil
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-# create umlbr1 and its taps
-#
-if [ `brctl show | grep umlbr1 | wc -l` -eq 1 ]
-then
- cecho " * Great, umlbr1 is already running!"
-else
- cecho-n " * Starting umlbr1 with taps.."
- umlbr_add 1 10.1.0.254 255.255.0.0
- umlbr_add_tap 1 alice
- umlbr_add_tap 1 venus
- umlbr_add_tap 1 moon
- cgecho "done"
-fi
-
-# create umlbr0 and its taps
-#
-if [ `brctl show | grep umlbr0 | wc -l` -eq 1 ]
-then
- cecho " * Great, umlbr0 is already running!"
-else
- cecho-n " * Starting umlbr0 with taps.."
- umlbr_add 0 192.168.0.254 255.255.255.0
- umlbr_add_tap 0 alice
- umlbr_add_tap 0 moon
- umlbr_add_tap 0 carol
- umlbr_add_tap 0 winnetou
- umlbr_add_tap 0 dave
- umlbr_add_tap 0 sun
- cgecho "done"
-fi
-
-# create umlbr2 and its taps
-#
-if [ `brctl show | grep umlbr2 | wc -l` -eq 1 ]
-then
- cecho " * Great, umlbr2 is already running!"
-else
- cecho-n " * Starting umlbr2 with taps.."
- umlbr_add 2 10.2.0.254 255.255.0.0
- umlbr_add_tap 2 sun
- umlbr_add_tap 2 bob
- cgecho "done"
-fi
-
diff --git a/testing/scripts/start-umls b/testing/scripts/start-umls
deleted file mode 100755
index 878494370..000000000
--- a/testing/scripts/start-umls
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/bin/bash
-# starts the UML instances with a hidden screen
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-if [ "$#" -eq 0 ]
-then
- HOSTS=$STRONGSWANHOSTS
-else
- HOSTS=$*
-fi
-
-BOOTING_HOSTS=""
-count_max=12
-count=0
-
-for host in $HOSTS
-do
- up=0
-
- if [ -d ~/.uml/${host} ]
- then
- pid=`cat ~/.uml/${host}/pid`
- up=`ps up $pid | wc -l`
- fi
-
- if [ $up -eq 2 ]
- then
- cecho " * Great, ${host} is already running!"
- else
- rm -rf ~/.uml/${host}
- BOOTING_HOSTS="$BOOTING_HOSTS ${host}"
- let "count_max += 12"
-
- UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host}
- [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found"
-
- cecho-n " * Starting ${host}.."
- eval screen -dmS ${host} "$UMLKERNEL \
- umid=${host} \
- ubda=$UMLHOSTFS \
- \$SWITCH_${host} \
- mem=${MEM}M con=pty con0=fd:0,fd:1"
- cgecho "done"
- fi
-done
-
-if [ -z "$BOOTING_HOSTS" ]
-then
- exit 0
-fi
-
-cecho " * Waiting for the uml instances to finish booting"
-
-for host in $BOOTING_HOSTS
-do
- cecho-n " * Checking on $host.."
-
- while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ]
- do
- cecho-n "."
- sleep 5
- let "count+=1"
- done
-
- if [ $count -ge $count_max ]
- then
- cecho "exit"
- exit 1
- fi
-
- up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l`
-
- while [ $count -lt $count_max ] && [ $up -eq 0 ]
- do
- cecho-n "."
- sleep 5
- up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l`
- let "count+=1"
- done
-
- if [ $count -ge $count_max ]
- then
- cecho "exit"
- exit 1
- else
- cgecho "up"
- fi
-
- if [ "$host" = "alice" ]
- then
- sleep 5
- eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
- ssh root@$ipv4_alice /etc/init.d/net.eth1 stop
- fi
-done
-
-cecho " * All uml instances are up now"
diff --git a/testing/scripts/stop-bridges b/testing/scripts/stop-bridges
deleted file mode 100755
index eb92bd0eb..000000000
--- a/testing/scripts/stop-bridges
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/bin/bash
-# stop the UML bridges in the kernel using the brctl command
-#
-# Copyright (C) 2009 Andreas Steffen
-# HSR Hochschule fuer Technik Rapperswil
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-# stop umlbr1 and its taps
-#
-cecho-n " * Stopping umlbr1 with taps.."
-umlbr_del_tap 1 alice
-umlbr_del_tap 1 venus
-umlbr_del_tap 1 moon
-umlbr_del 1
-cgecho "done"
-
-# stop umlbr0 and its taps
-#
-cecho-n " * Stopping umlbr0 with taps.."
-umlbr_del_tap 0 alice
-umlbr_del_tap 0 moon
-umlbr_del_tap 0 carol
-umlbr_del_tap 0 winnetou
-umlbr_del_tap 0 dave
-umlbr_del_tap 0 sun
-umlbr_del 0
-cgecho "done"
-
-# stop umlbr2 and its taps
-#
-cecho-n " * Stopping umlbr2 with taps.."
-umlbr_del_tap 2 sun
-umlbr_del_tap 2 bob
-umlbr_del 2
-cgecho "done"
-
diff --git a/testing/scripts/xstart-umls b/testing/scripts/xstart-umls
deleted file mode 100755
index ed2662b6c..000000000
--- a/testing/scripts/xstart-umls
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/bin/bash
-# starts the UML instances in an xterm (requires X11R6)
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/function.sh
-
-[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
-
-source $DIR/../testing.conf
-
-if [ "$#" -eq 0 ]
-then
- HOSTS=$STRONGSWANHOSTS
-else
- HOSTS=$*
-fi
-
-BOOTING_HOSTS=""
-count_max=12
-count=0
-
-#position of xterm window on the desktop
-x0=8
-y0=8
-dx=12
-dy=24
-
-for host in $HOSTS
-do
- up=0
-
- if [ -d ~/.uml/${host} ]
- then
- pid=`cat ~/.uml/${host}/pid`
- up=`ps up $pid | wc -l`
- fi
-
- if [ $up -eq 2 ]
- then
- cecho " * Great, ${host} is already running!"
- else
- rm -rf ~/.uml/${host}
- BOOTING_HOSTS="$BOOTING_HOSTS ${host}"
- let "count_max += 12"
-
- UMLHOSTFS=$BUILDDIR/root-fs/gentoo-fs-${host}
- [ -f $UMLHOSTFS ] || die "!! uml root file system '$UMLHOSTFS' not found"
-
- cecho-n " * Starting ${host}.."
- eval xterm -title ${host} -geometry "+${x0}+${y0}" -rightbar -sb -sl 500 -e "$UMLKERNEL \
- umid=${host} \
- ubda=$UMLHOSTFS \
- \$SWITCH_${host} \
- mem=${MEM}M con=pty con0=fd:0,fd:1" &
- cgecho "done"
- sleep 15
- fi
- let "x0+=dx"
- let "y0+=dy"
-done
-
-if [ -z "$BOOTING_HOSTS" ]
-then
- exit 0
-fi
-
-cecho " * Waiting for the uml instances to finish booting"
-
-for host in $BOOTING_HOSTS
-do
- cecho-n " * Checking on $host.."
-
- while [ $count -lt $count_max ] && [ ! -d ~/.uml/$host ]
- do
- cecho-n "."
- sleep 5
- let "count+=1"
- done
-
- if [ $count -ge $count_max ]
- then
- cecho "exit"
- exit 1
- fi
-
- up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l`
-
- while [ $count -lt $count_max ] && [ $up -eq 0 ]
- do
- cecho-n "."
- sleep 5
- up=`uml_mconsole $host proc net/route 2> /dev/null | grep eth0 | wc -l`
- let "count+=1"
- done
-
- if [ $count -ge $count_max ]
- then
- cecho "exit"
- exit 1
- else
- cgecho "up"
- fi
-
- if [ "$host" = "alice" ]
- then
- sleep 5
- eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
- ssh root@$ipv4_alice /etc/init.d/net.eth1 stop
- fi
-done
-
-cecho " * All uml instances are up now"
diff --git a/testing/ssh_config b/testing/ssh_config
index 36569c07c..831b9dc1a 100644
--- a/testing/ssh_config
+++ b/testing/ssh_config
@@ -1,7 +1,8 @@
Host *
# debian default
SendEnv LANG LC_*
- HashKnownHosts yes
+ StrictHostKeyChecking no
+ UserKnownHostsFile /dev/null
GSSAPIAuthentication yes
# faster encryption
Ciphers arcfour
diff --git a/testing/start-testing b/testing/start-testing
index 278500e6f..183729423 100755
--- a/testing/start-testing
+++ b/testing/start-testing
@@ -1,85 +1,48 @@
#!/bin/bash
-# Start up the specified UML instances and wait for them to finish booting
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/scripts/function.sh
-
-[ -f $DIR/testing.conf ] || die "!! Configuration file 'testing.conf' not found"
-[ -d $DIR/hosts ] || die "Directory hosts cannot be found."
-
-source $DIR/testing.conf
-
-if [ "$#" -eq 0 ]
-then
- HOSTS=$STRONGSWANHOSTS
-else
- HOSTS=$*
-fi
-
-#####################################################
-# start the uml bridges
-#
-cecho "Start the uml bridges (scripts/start-bridges)"
-$DIR/scripts/start-bridges
-
-
-#####################################################
-# start the uml instances
-#
-case $UMLSTARTMODE in
- konsole)
- cecho "Start the uml instances (scripts/kstart-umls)"
- $DIR/scripts/kstart-umls $HOSTS
- ;;
- gnome-terminal)
- cecho "Start the uml instances (scripts/gstart-umls)"
- $DIR/scripts/gstart-umls $HOSTS
- ;;
- xterm)
- cecho "Start the uml instances (scripts/xstart-umls)"
- $DIR/scripts/xstart-umls $HOSTS
- ;;
- screen)
- cecho "Start the uml instances (scripts/start-umls)"
- $DIR/scripts/start-umls $HOSTS
- ;;
- *)
- die "The start mode is unknown! Please set $UMLSTARTMODE properly."
- ;;
-esac
-
-
-#####################################################
-# do the automated testing
-#
-if [ $ENABLE_DO_TESTS = "yes" ]
-then
- cecho "Run the automated tests (do-tests)"
- $DIR/do-tests
-fi
-
-
-##############################################################################
-# stop all UML instances and switches
-#
-
-if [ $ENABLE_STOP_TESTING = "yes" ]
-then
- cecho "Stopping all UML instances and switches (stop-testing)"
- $DIR/stop-testing $HOSTS
-fi
+DIR=$(dirname `readlink -f $0`)
+. $DIR/testing.conf
+. $DIR/scripts/function.sh
+
+NETWORKS="vnet1 vnet2 vnet3"
+CONFDIR=$DIR/config/kvm
+KNLSRC=$BUILDDIR/$KERNEL/arch/x86/boot/bzImage
+KNLTARGET=/var/run/kvm-swan-kernel
+HOSTFSTARGET=/var/run/kvm-swan-hostfs
+MCASTBRS="virbr1 virbr2"
+
+echo "Starting test environment"
+
+[ `id -u` -eq 0 ] || die "You must be root to run $0"
+
+check_commands virsh
+
+log_action "Deploying kernel $KERNEL"
+execute "ln -fs $KNLSRC $KNLTARGET"
+
+log_action "Deploying $SHAREDDIR as hostfs"
+execute "chown -R $KVMUSER:$KVMGROUP $SHAREDDIR" 0
+execute "ln -Tfs $SHAREDDIR $HOSTFSTARGET"
+
+for net in $NETWORKS
+do
+ log_action "Network $net"
+ execute "virsh net-create $CONFDIR/$net.xml"
+done
+
+for host in $STRONGSWANHOSTS
+do
+ ln -fs $IMGDIR/$host.$IMGEXT $VIRTIMGSTORE/$host.$IMGEXT
+ log_action "Guest $host"
+ execute "virsh create $CONFDIR/$host.xml"
+done
+
+# Enforce reception of multicast traffic on bridges
+for br in $MCASTBRS
+do
+ cd /sys/devices/virtual/net/$br/brif
+ for vnet in `find . -name "vnet*"`
+ do
+ echo 2 > $vnet/multicast_router
+ done
+done
diff --git a/testing/stop-testing b/testing/stop-testing
index 023a5b39e..704ae6667 100755
--- a/testing/stop-testing
+++ b/testing/stop-testing
@@ -1,48 +1,34 @@
#!/bin/bash
-# Stop all UML instances and UML switches
-#
-# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-# for more details.
-
-DIR=`dirname $0`
-
-source $DIR/scripts/function.sh
-
-[ -f $DIR/testing.conf ] || die "No configuration file testing.conf found."
-
-source $DIR/testing.conf
-
-if [ "$#" -eq 0 ]
-then
- HOSTS=$STRONGSWANHOSTS
-else
- HOSTS=$*
-fi
-
-#####################################################
-# Shutting down the uml instances
-#
-cecho-n " * Halting all UML instances.."
-for host in $HOSTS
+
+DIR=$(dirname `readlink -f $0`)
+. $DIR/testing.conf
+. $DIR/scripts/function.sh
+
+echo "Stopping test environment"
+
+NETWORKS="vnet1 vnet2 vnet3"
+KNLTARGET=/var/run/kvm-swan-kernel
+HOSTFSTARGET=/var/run/kvm-swan-hostfs
+
+[ `id -u` -eq 0 ] || die "You must be root to run $0"
+
+check_commands virsh
+
+for net in $NETWORKS
do
- uml_mconsole $host halt &> /dev/null
+ log_action "Network $net"
+ execute "virsh net-destroy $net"
done
-cgecho "done"
-#####################################################
-# Shutting down the uml bridhges
-#
-cecho "Stop the uml bridges (scripts/stop-bridges)"
-$DIR/scripts/stop-bridges
+for host in $STRONGSWANHOSTS
+do
+ log_action "Guest $host"
+ execute "virsh shutdown $host"
+ rm -f $VIRTIMGSTORE/$host.$IMGEXT
+done
+log_action "Removing kernel $KERNEL"
+execute "rm $KNLTARGET"
+log_action "Removing link to hostfs"
+execute "rm $HOSTFSTARGET"
diff --git a/testing/testing.conf b/testing/testing.conf
index d0c918860..960d3f63e 100755..100644
--- a/testing/testing.conf
+++ b/testing/testing.conf
@@ -1,5 +1,5 @@
#!/bin/bash
-# Global configuration file for strongswan UML testing.
+# Global configuration file for strongswan integration testing.
#
# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
# Zuercher Hochschule Winterthur
@@ -15,146 +15,66 @@
# for more details.
# Root directory of testing
-UMLTESTDIR=~/strongswan-testing
-
-# Bzipped kernel sources
-# (file extension .tar.bz2 required)
-KERNEL=$UMLTESTDIR/linux-3.5.3.tar.bz2
-
-# Extract kernel version
-KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'`
-
-# Kernel configuration file
-KERNELCONFIG=$UMLTESTDIR/.config-3.5
-
-
-# Bzipped uml patch for kernel
-UMLPATCH=$UMLTESTDIR/ha-3.0.patch.bz2
-
-# Bzipped source of strongSwan
-STRONGSWAN=$UMLTESTDIR/strongswan-5.0.1.tar.bz2
-
-# strongSwan compile options (use "yes" or "no")
-USE_LIBCURL="yes"
-USE_LDAP="yes"
-USE_EAP_AKA="yes"
-USE_EAP_SIM="yes"
-USE_EAP_MD5="yes"
-USE_EAP_MSCHAPV2="yes"
-USE_EAP_IDENTITY="yes"
-USE_EAP_RADIUS="yes"
-USE_EAP_DYNAMIC="yes"
-USE_EAP_TLS="yes"
-USE_EAP_TTLS="yes"
-USE_EAP_PEAP="yes"
-USE_EAP_TNC="yes"
-USE_TNC_PDP="yes"
-USE_TNC_IMC="yes"
-USE_TNC_IMV="yes"
-USE_TNCCS_11="yes"
-USE_TNCCS_20="yes"
-USE_TNCCS_DYNAMIC="yes"
-USE_IMC_TEST="yes"
-USE_IMV_TEST="yes"
-USE_IMC_SCANNER="yes"
-USE_IMV_SCANNER="yes"
-USE_IMC_ATTESTATION="yes"
-USE_IMV_ATTESTATION="yes"
-USE_SQL="yes"
-USE_MEDIATION="yes"
-USE_OPENSSL="yes"
-USE_BLOWFISH="yes"
-USE_KERNEL_PFKEY="yes"
-USE_INTEGRITY_TEST="yes"
-USE_LEAK_DETECTIVE="yes"
-USE_LOAD_TESTER="yes"
-USE_TEST_VECTORS="yes"
-USE_GCRYPT="yes"
-USE_SOCKET_DEFAULT="yes"
-USE_SOCKET_DYNAMIC="yes"
-USE_DHCP="yes"
-USE_FARP="yes"
-USE_ADDRBLOCK="yes"
-USE_CTR="yes"
-USE_CCM="yes"
-USE_GCM="yes"
-USE_CMAC="yes"
-USE_HA="yes"
-USE_AF_ALG="yes"
-USE_WHITELIST="yes"
-USE_XAUTH_GENERIC="yes"
-USE_XAUTH_EAP="yes"
-USE_PKCS8="yes"
-USE_IFMAP="no"
-USE_CISCO_QUIRKS="no"
-USE_UNITY="yes"
-
-# Gentoo linux root filesystem
-ROOTFS=$UMLTESTDIR/gentoo-fs-20111212.tar.bz2
-
-# Size of the finished root filesystem in MB
-ROOTFSSIZE=850
-
-# Amount of Memory to use per UML [MB].
-# If "auto" is stated 1/12 of total host ram will be used.
-# Examples: MEM=64, MEM="128", MEM="auto"
-MEM=96
-
-# Directory where the UML kernels and file system will be built
-BUILDDIR=$UMLTESTDIR/umlbuild
-
-# Filename of the built UML Kernel
-UMLKERNEL=$BUILDDIR/linux-uml-$KERNELVERSION
+TESTDIR=/srv/strongswan-testing
+
+# Kernel configuration
+KERNELVERSION=3.5.3
+KERNEL=linux-$KERNELVERSION
+KERNELTARBALL=$KERNEL.tar.bz2
+KERNELCONFIG=$DIR/../config/kernel/config-3.5
+KERNELPATCH=ha-3.0.patch.bz2
+
+# strongSwan version used in tests
+SWANVERSION=5.0.2dr4
+
+# Build directory where the guest kernel and images will be built
+BUILDDIR=$TESTDIR/build
+# Directory shared between host and guests
+SHAREDDIR=$BUILDDIR/shared
+
+# Logfile
+LOGFILE=$BUILDDIR/testing.log
+
+# Directory used for loop-mounts
+LOOPDIR=$BUILDDIR/loop
+
+# Common image settings
+IMGEXT=qcow2
+IMGDIR=$BUILDDIR/images
+
+# Base image settings
+# The base image is a pristine OS installation created using debootstrap.
+BASEIMGSIZE=1024
+BASEIMGSUITE=wheezy
+BASEIMGARCH=amd64
+BASEIMG=$IMGDIR/debian-$BASEIMGSUITE-$BASEIMGARCH.$IMGEXT
+BASEIMGMIRROR=http://cdn.debian.net/debian
+
+# Root image settings
+# The root image is the origin of all guest images. It is a clone of the base
+# image and contains additional test-specific software and patches.
+ROOTIMG=$IMGDIR/root.$IMGEXT
+
+# libvirt config
+NBDEV=/dev/nbd0
+NBDPARTITION=${NBDEV}p1
+VIRTIMGSTORE=/var/lib/libvirt/images
+KVMUSER=libvirt-qemu
+KVMGROUP=kvm
# Directory where test results will be stored
-TESTRESULTSDIR=$UMLTESTDIR/testresults
+TESTRESULTSDIR=$TESTDIR/testresults
# SSH configuration (speedup SSH)
-SSHCONF="-F $UMLTESTDIR/testing/ssh_config"
-
-# Path to a full strongswan tree on the host system, which is
-# mounted into /root/strongswan-shared. This gives us an easy
-# way to apply and test changes instantly.
-#SHAREDTREE=/home/martin/strongswan/trunk
-
-# Timezone for the UMLs, look in /usr/share/zoneinfo!
-TZUML="Europe/Zurich"
-
-##############################################################
-# Enable particular steps in the make-testing and
-# start-testing scripts
-#
-ENABLE_BUILD_UMLKERNEL="yes"
-ENABLE_BUILD_SSHKEYS="yes"
-ENABLE_BUILD_HOSTCONFIG="yes"
-ENABLE_BUILD_UMLROOTFS="yes"
-ENABLE_BUILD_UMLHOSTFS="yes"
-ENABLE_START_TESTING="yes"
-ENABLE_DO_TESTS="no"
-ENABLE_STOP_TESTING="no"
+SSHCONF="-F $TESTDIR/testing/ssh_config"
##############################################################
-# How to start the UMLs?
-#
-# Start the UML instance in KDE konsole (requires KDE)
-# UMLSTARTMODE="konsole"
-# Start the UML instance in a gnome-terminal (requires gnome)
-UMLSTARTMODE="gnome-terminal"
-# Start the UML instance in an xterm (requires X11R6)
-# UMLSTARTMODE="xterm"
-# Start the UML instance without a terminal window
-# but screen -r <host> can open a window anytime
-# UMLSTARTMODE="screen"
-
-##############################################################
-# If set to "yes" only the tests stated at $SELECTEDTESTS
-# will be executed. (use "yes" or "no")
-#
-SELECTEDTESTSONLY="no"
-
-# Tests to do if $SELECTEDTESTSONLY is set "yes".
+# Enable particular steps in the make-testing
#
-SELECTEDTESTS="ikev2/rw-cert"
+ENABLE_BUILD_BASEIMAGE="yes"
+ENABLE_BUILD_ROOTIMAGE="yes"
+ENABLE_BUILD_GUESTKERNEL="yes"
+ENABLE_BUILD_GUESTIMAGES="yes"
##############################################################
# hostname and corresponding IPv4 and IPv6 addresses
@@ -186,35 +106,5 @@ bob,fec2::10"
# VPN gateways / clients
# The hosts stated here will be created. Possible values
# are sun, moon, dave, carol, alice, venus, bob, winnetou.
-# It's fine to make them all unless you don't have much
-# resources. In this case we assume you know what you do!
-#
-STRONGSWANHOSTS="sun moon dave carol alice venus bob winnetou"
-
-##############################################################
-# Needed programs, do not change!
-#
-PROGRAMS="uml_switch uml_mconsole ssh ssh-keygen iptables \
- chroot screen mkreiserfs"
-
-##############################################################
-# IP parameters of the UML switches
-#
-IFCONFIG_0="192.168.0.254 netmask 255.255.255.0"
-IFCONFIG_1="10.1.0.254 netmask 255.255.0.0"
-IFCONFIG_2="10.2.0.254 netmask 255.255.0.0"
-
-##############################################################
-# Network interfaces of the UML instances
#
-SWITCH_alice="eth0=tuntap,tap1_alice,fe:fd:0a:01:00:0a \
- eth1=tuntap,tap0_alice,fe:fd:c0:a8:00:32"
-SWITCH_venus="eth0=tuntap,tap1_venus,fe:fd:0a:01:00:14"
-SWITCH_moon="eth0=tuntap,tap0_moon,fe:fd:c0:a8:00:01 \
- eth1=tuntap,tap1_moon,fe:fd:0a:01:00:01"
-SWITCH_carol="eth0=tuntap,tap0_carol,fe:fd:c0:a8:00:64"
-SWITCH_winnetou="eth0=tuntap,tap0_winnetou,fe:fd:c0:a8:00:96"
-SWITCH_dave="eth0=tuntap,tap0_dave,fe:fd:c0:a8:00:c8"
-SWITCH_sun="eth0=tuntap,tap0_sun,fe:fd:c0:a8:00:02 \
- eth1=tuntap,tap2_sun,fe:fd:0a:02:00:01"
-SWITCH_bob="eth0=tuntap,tap2_bob,fe:fd:0a:02:00:0a"
+STRONGSWANHOSTS="alice bob carol dave moon sun venus winnetou"
diff --git a/testing/tests/af-alg/alg-camellia/evaltest.dat b/testing/tests/af-alg/alg-camellia/evaltest.dat
index 72e3c5e29..2096cb994 100644
--- a/testing/tests/af-alg/alg-camellia/evaltest.dat
+++ b/testing/tests/af-alg/alg-camellia/evaltest.dat
@@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
moon:: ip xfrm state::enc cbc(camellia)::YES
diff --git a/testing/tests/af-alg/alg-camellia/posttest.dat b/testing/tests/af-alg/alg-camellia/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/af-alg/alg-camellia/posttest.dat
+++ b/testing/tests/af-alg/alg-camellia/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/af-alg/alg-camellia/pretest.dat b/testing/tests/af-alg/alg-camellia/pretest.dat
index 3c3df0196..886fdf55c 100644
--- a/testing/tests/af-alg/alg-camellia/pretest.dat
+++ b/testing/tests/af-alg/alg-camellia/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/af-alg/alg-camellia/test.conf b/testing/tests/af-alg/alg-camellia/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/af-alg/alg-camellia/test.conf
+++ b/testing/tests/af-alg/alg-camellia/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/af-alg/rw-cert/evaltest.dat b/testing/tests/af-alg/rw-cert/evaltest.dat
index f8cfb111b..ba661975b 100644
--- a/testing/tests/af-alg/rw-cert/evaltest.dat
+++ b/testing/tests/af-alg/rw-cert/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/af-alg/rw-cert/posttest.dat b/testing/tests/af-alg/rw-cert/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/af-alg/rw-cert/posttest.dat
+++ b/testing/tests/af-alg/rw-cert/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/af-alg/rw-cert/pretest.dat b/testing/tests/af-alg/rw-cert/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/af-alg/rw-cert/pretest.dat
+++ b/testing/tests/af-alg/rw-cert/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/af-alg/rw-cert/test.conf b/testing/tests/af-alg/rw-cert/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/af-alg/rw-cert/test.conf
+++ b/testing/tests/af-alg/rw-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat b/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat
index 81e413f98..db5a76204 100644
--- a/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat
+++ b/testing/tests/gcrypt-ikev1/alg-serpent/evaltest.dat
@@ -4,7 +4,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: SERPENT_CBC_256/HMAC_SHA2_512_256::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: SERPENT_CBC_256/HMAC_SHA2_512_256::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ipsec statusall 2> /dev/null::SERPENT_CBC_256/HMAC_SHA2_512_256,::YES
moon:: ipsec statusall 2> /dev/null::SERPENT_CBC_256/HMAC_SHA2_512_256,::YES
carol::ip xfrm state::enc cbc(serpent)::YES
diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat b/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat
index 6d2eeb5f9..1b8fc3b79 100644
--- a/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat
+++ b/testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
moon::ipsec start
carol::sleep 2
diff --git a/testing/tests/gcrypt-ikev1/alg-serpent/test.conf b/testing/tests/gcrypt-ikev1/alg-serpent/test.conf
index 6abbb89a9..d7b71426c 100644
--- a/testing/tests/gcrypt-ikev1/alg-serpent/test.conf
+++ b/testing/tests/gcrypt-ikev1/alg-serpent/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat b/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat
index 7003977f9..ac3b5e0b0 100644
--- a/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat
+++ b/testing/tests/gcrypt-ikev1/alg-twofish/evaltest.dat
@@ -4,7 +4,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: TWOFISH_CBC_256/HMAC_SHA2_512_256::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES
moon:: ipsec statusall 2> /dev/null::TWOFISH_CBC_256/HMAC_SHA2_512_256,::YES
carol::ip xfrm state::enc cbc(twofish)::YES
diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat b/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat
index 6d2eeb5f9..1b8fc3b79 100644
--- a/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat
+++ b/testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
moon::ipsec start
carol::sleep 2
diff --git a/testing/tests/gcrypt-ikev1/alg-twofish/test.conf b/testing/tests/gcrypt-ikev1/alg-twofish/test.conf
index 6abbb89a9..d7b71426c 100644
--- a/testing/tests/gcrypt-ikev1/alg-twofish/test.conf
+++ b/testing/tests/gcrypt-ikev1/alg-twofish/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat
index d82b68dcb..5f0bb3cdc 100644
--- a/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat
+++ b/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat
@@ -4,7 +4,7 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
moon:: ip xfrm state::enc cbc(camellia)::YES
diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat
+++ b/testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat
index 3c3df0196..886fdf55c 100644
--- a/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat
+++ b/testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/test.conf b/testing/tests/gcrypt-ikev2/alg-camellia/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/gcrypt-ikev2/alg-camellia/test.conf
+++ b/testing/tests/gcrypt-ikev2/alg-camellia/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat b/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat
index b545c2289..2342d024b 100644
--- a/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat
+++ b/testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat b/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat
+++ b/testing/tests/gcrypt-ikev2/rw-cert/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat b/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat
+++ b/testing/tests/gcrypt-ikev2/rw-cert/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/gcrypt-ikev2/rw-cert/test.conf b/testing/tests/gcrypt-ikev2/rw-cert/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/gcrypt-ikev2/rw-cert/test.conf
+++ b/testing/tests/gcrypt-ikev2/rw-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ha/both-active/evaltest.dat b/testing/tests/ha/both-active/evaltest.dat
index 36d72ff97..89e5f4b6e 100644
--- a/testing/tests/ha/both-active/evaltest.dat
+++ b/testing/tests/ha/both-active/evaltest.dat
@@ -8,8 +8,8 @@ alice::cat /var/log/daemon.log::HA segment 1 activated::YES
moon:: cat /var/log/daemon.log::HA segment 2 activated::YES
alice::cat /var/log/daemon.log::handling HA CHILD_SA::YES
moon:: cat /var/log/daemon.log::installed HA CHILD_SA::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
carol::tcpdump::IP carol.strongswan.org > mars.strongswan.org: ESP::YES
carol::tcpdump::IP mars.strongswan.org > carol.strongswan.org: ESP::YES
dave::tcpdump::IP dave.strongswan.org > mars.strongswan.org: ESP::YES
diff --git a/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables b/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index 95d3b8828..000000000
--- a/testing/tests/ha/both-active/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # forward ESP-tunneled traffic
- iptables -A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT
- iptables -A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT
- iptables -A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-
- # clusterip rules
- iptables -A INPUT -i eth1 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip \
- --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 2
- iptables -A INPUT -i eth0 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip \
- --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 2
-
- # allow esp
- iptables -A INPUT -p 50 -j ACCEPT
- iptables -A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT
- iptables -A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow heartbeat
- iptables -A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT
- iptables -A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT
-
- # allow ICMP type 3
- iptables -A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT
- iptables -A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT
-
- # allow IGMP multicasts
- iptables -A INPUT -d 224.0.0.1 -p igmp -j ACCEPT
- iptables -A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules b/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules
new file mode 100644
index 000000000..cad1d202a
--- /dev/null
+++ b/testing/tests/ha/both-active/hosts/alice/etc/iptables.rules
@@ -0,0 +1,50 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# forward ESP-tunneled traffic
+-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT
+-A FORWARD -i eth1 -m policy --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT
+-A FORWARD -o eth1 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+# clusterip rules
+-A INPUT -i eth1 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 2
+-A INPUT -i eth0 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 2
+
+# allow esp
+-A INPUT -p 50 -j ACCEPT
+-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT
+-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow heartbeat
+-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT
+-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p udp --dport 4510 --sport 4510 -j ACCEPT
+
+# allow ICMP type 3
+-A INPUT -i eth0 -d PH_IP_ALICE -s PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT
+-A OUTPUT -o eth0 -s PH_IP_ALICE -d PH_IP_MOON1 -p icmp --icmp-type 3 -j ACCEPT
+
+# allow IGMP multicasts
+-A INPUT -d 224.0.0.1 -p igmp -j ACCEPT
+-A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables b/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 6f7a0316b..000000000
--- a/testing/tests/ha/both-active/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # forward ESP-tunneled traffic
- iptables -A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT
- iptables -A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT
- iptables -A FORWARD -m policy -o eth0 --dir out --pol ipsec --proto esp -j ACCEPT
-
- # clusterip rules
- iptables -A INPUT -i eth0 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip \
- --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 1
- iptables -A INPUT -i eth1 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip \
- --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 1
-
- # allow esp
- iptables -A INPUT -p 50 -j ACCEPT
- iptables -A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT
- iptables -A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow heartbeat
- iptables -A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT
- iptables -A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT
-
- # allow ICMP type 3
- iptables -A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT
- iptables -A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT
-
- # allow IGMP multicasts
- iptables -A INPUT -d 224.0.0.1 -p igmp -j ACCEPT
- iptables -A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules b/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..ab7fd7fcb
--- /dev/null
+++ b/testing/tests/ha/both-active/hosts/moon/etc/iptables.rules
@@ -0,0 +1,50 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# forward ESP-tunneled traffic
+-A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_CAROL -j ACCEPT
+-A FORWARD -m policy -i eth0 --dir in --pol ipsec --proto esp -s PH_IP_DAVE -j ACCEPT
+-A FORWARD -m policy -o eth0 --dir out --pol ipsec --proto esp -j ACCEPT
+
+# clusterip rules
+-A INPUT -i eth0 -d 192.168.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:c0:a8:00:05 --total-nodes 2 --local-node 1
+-A INPUT -i eth1 -d 10.1.0.5 -j CLUSTERIP --new --hashmode sourceip --clustermac 01:00:0a:01:00:05 --total-nodes 2 --local-node 1
+
+# allow esp
+-A INPUT -p 50 -j ACCEPT
+-A OUTPUT -p 50 -d PH_IP_CAROL -j ACCEPT
+-A OUTPUT -p 50 -d PH_IP_DAVE -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow heartbeat
+-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT
+-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p udp --dport 4510 --sport 4510 -j ACCEPT
+
+# allow ICMP type 3
+-A INPUT -i eth1 -d PH_IP_MOON1 -s PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT
+-A OUTPUT -o eth1 -s PH_IP_MOON1 -d PH_IP_ALICE -p icmp --icmp-type 3 -j ACCEPT
+
+# allow IGMP multicasts
+-A INPUT -d 224.0.0.1 -p igmp -j ACCEPT
+-A OUTPUT -s 224.0.0.1 -p igmp -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ha/both-active/posttest.dat b/testing/tests/ha/both-active/posttest.dat
index 49bf76055..e4ffe8eef 100644
--- a/testing/tests/ha/both-active/posttest.dat
+++ b/testing/tests/ha/both-active/posttest.dat
@@ -2,15 +2,15 @@ carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
alice::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-alice::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+alice::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::ip addr del 192.168.0.5/24 dev eth0
moon::ip addr del 10.1.0.5/16 dev eth1
alice::ip addr del 192.168.0.5/24 dev eth1
alice::ip addr del 10.1.0.5/16 dev eth0
-alice::/etc/init.d/net.eth1 stop
+alice::ifdown eth1
venus::ip route del default via 10.1.0.5 dev eth0
venus::ip route add default via 10.1.0.1 dev eth0
moon::conntrack -F
diff --git a/testing/tests/ha/both-active/pretest.dat b/testing/tests/ha/both-active/pretest.dat
index e2e509855..af4d66cfc 100644
--- a/testing/tests/ha/both-active/pretest.dat
+++ b/testing/tests/ha/both-active/pretest.dat
@@ -1,14 +1,14 @@
moon::ip addr add 192.168.0.5/24 dev eth0
moon::ip addr add 10.1.0.5/16 dev eth1
-alice::/etc/init.d/net.eth1 start
+alice::ifup eth1
alice::ip addr add 192.168.0.5/24 dev eth1
alice::ip addr add 10.1.0.5/16 dev eth0
venus::ip route del default via 10.1.0.1 dev eth0
venus::ip route add default via 10.1.0.5 dev eth0
-moon::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+alice::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
alice::ipsec start
carol::ipsec start
diff --git a/testing/tests/ha/both-active/test.conf b/testing/tests/ha/both-active/test.conf
index 0473013e1..8056d9ce4 100644
--- a/testing/tests/ha/both-active/test.conf
+++ b/testing/tests/ha/both-active/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="venus carol dave"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice moon carol dave"
diff --git a/testing/tests/ike/rw-cert/evaltest.dat b/testing/tests/ike/rw-cert/evaltest.dat
index c8fcb2370..e431ce533 100644
--- a/testing/tests/ike/rw-cert/evaltest.dat
+++ b/testing/tests/ike/rw-cert/evaltest.dat
@@ -10,8 +10,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ike/rw-cert/pretest.dat b/testing/tests/ike/rw-cert/pretest.dat
index 587b6aeed..e50793830 100644
--- a/testing/tests/ike/rw-cert/pretest.dat
+++ b/testing/tests/ike/rw-cert/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ike/rw-cert/test.conf b/testing/tests/ike/rw-cert/test.conf
index 845a6dcd7..51bf2b7f2 100644
--- a/testing/tests/ike/rw-cert/test.conf
+++ b/testing/tests/ike/rw-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ike/rw_v1-net_v2/evaltest.dat b/testing/tests/ike/rw_v1-net_v2/evaltest.dat
index f12b19e3d..847a2d92d 100644
--- a/testing/tests/ike/rw_v1-net_v2/evaltest.dat
+++ b/testing/tests/ike/rw_v1-net_v2/evaltest.dat
@@ -2,13 +2,13 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ike/rw_v1-net_v2/pretest.dat b/testing/tests/ike/rw_v1-net_v2/pretest.dat
index 03b8dc218..f61a4cb51 100644
--- a/testing/tests/ike/rw_v1-net_v2/pretest.dat
+++ b/testing/tests/ike/rw_v1-net_v2/pretest.dat
@@ -1,5 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
-sun::echo 1 > /proc/sys/net/ipv4/ip_forward
moon::ipsec start
sun::ipsec start
carol::ipsec start
diff --git a/testing/tests/ike/rw_v1-net_v2/test.conf b/testing/tests/ike/rw_v1-net_v2/test.conf
index 983881e5d..864f944d7 100644
--- a/testing/tests/ike/rw_v1-net_v2/test.conf
+++ b/testing/tests/ike/rw_v1-net_v2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="carol moon sun"
diff --git a/testing/tests/ikev1/alg-3des-md5/evaltest.dat b/testing/tests/ikev1/alg-3des-md5/evaltest.dat
index a553ff168..abd29e97e 100644
--- a/testing/tests/ikev1/alg-3des-md5/evaltest.dat
+++ b/testing/tests/ikev1/alg-3des-md5/evaltest.dat
@@ -4,12 +4,12 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*3DES_CBC/HMAC_MD5_96,::YES
carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_MD5_96,::YES
moon:: ip xfrm state::enc cbc(des3_ede)::YES
carol::ip xfrm state::enc cbc(des3_ede)::YES
-moon:: ip xfrm state::auth hmac(md5)::YES
-carol::ip xfrm state::auth hmac(md5)::YES
+moon:: ip xfrm state::auth-trunc hmac(md5)::YES
+carol::ip xfrm state::auth-trunc hmac(md5)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES
diff --git a/testing/tests/ikev1/alg-3des-md5/posttest.dat b/testing/tests/ikev1/alg-3des-md5/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/alg-3des-md5/posttest.dat
+++ b/testing/tests/ikev1/alg-3des-md5/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/alg-3des-md5/pretest.dat b/testing/tests/ikev1/alg-3des-md5/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev1/alg-3des-md5/pretest.dat
+++ b/testing/tests/ikev1/alg-3des-md5/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/alg-3des-md5/test.conf b/testing/tests/ikev1/alg-3des-md5/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/alg-3des-md5/test.conf
+++ b/testing/tests/ikev1/alg-3des-md5/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/alg-blowfish/evaltest.dat b/testing/tests/ikev1/alg-blowfish/evaltest.dat
index 3787bdb68..cd83c56b4 100644
--- a/testing/tests/ikev1/alg-blowfish/evaltest.dat
+++ b/testing/tests/ikev1/alg-blowfish/evaltest.dat
@@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES
dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_384_192,::YES
dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA2_256_128,::YES
carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES
diff --git a/testing/tests/ikev1/alg-blowfish/posttest.dat b/testing/tests/ikev1/alg-blowfish/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/alg-blowfish/posttest.dat
+++ b/testing/tests/ikev1/alg-blowfish/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/alg-blowfish/pretest.dat b/testing/tests/ikev1/alg-blowfish/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev1/alg-blowfish/pretest.dat
+++ b/testing/tests/ikev1/alg-blowfish/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev1/alg-blowfish/test.conf b/testing/tests/ikev1/alg-blowfish/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/alg-blowfish/test.conf
+++ b/testing/tests/ikev1/alg-blowfish/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat b/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat
index c07c176b5..8230ee30c 100644
--- a/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat
+++ b/testing/tests/ikev1/alg-modp-subgroup/evaltest.dat
@@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024_160::YES
dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048_256::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/alg-modp-subgroup/posttest.dat b/testing/tests/ikev1/alg-modp-subgroup/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/alg-modp-subgroup/posttest.dat
+++ b/testing/tests/ikev1/alg-modp-subgroup/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/alg-modp-subgroup/pretest.dat b/testing/tests/ikev1/alg-modp-subgroup/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev1/alg-modp-subgroup/pretest.dat
+++ b/testing/tests/ikev1/alg-modp-subgroup/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev1/alg-modp-subgroup/test.conf b/testing/tests/ikev1/alg-modp-subgroup/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/alg-modp-subgroup/test.conf
+++ b/testing/tests/ikev1/alg-modp-subgroup/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/alg-sha256/evaltest.dat b/testing/tests/ikev1/alg-sha256/evaltest.dat
index 7b5640af8..eba856742 100644
--- a/testing/tests/ikev1/alg-sha256/evaltest.dat
+++ b/testing/tests/ikev1/alg-sha256/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_128,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128,::YES
-moon:: ip xfrm state::auth hmac(sha256)::YES
-carol::ip xfrm state::auth hmac(sha256)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha256)::YES
+carol::ip xfrm state::auth-trunc hmac(sha256)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 200::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 200::YES
diff --git a/testing/tests/ikev1/alg-sha256/posttest.dat b/testing/tests/ikev1/alg-sha256/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/alg-sha256/posttest.dat
+++ b/testing/tests/ikev1/alg-sha256/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/alg-sha256/pretest.dat b/testing/tests/ikev1/alg-sha256/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev1/alg-sha256/pretest.dat
+++ b/testing/tests/ikev1/alg-sha256/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/alg-sha256/test.conf b/testing/tests/ikev1/alg-sha256/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/alg-sha256/test.conf
+++ b/testing/tests/ikev1/alg-sha256/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/alg-sha384/evaltest.dat b/testing/tests/ikev1/alg-sha384/evaltest.dat
index 21b3d5a4f..3b24217c5 100644
--- a/testing/tests/ikev1/alg-sha384/evaltest.dat
+++ b/testing/tests/ikev1/alg-sha384/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES
-moon:: ip xfrm state::auth hmac(sha384)::YES
-carol::ip xfrm state::auth hmac(sha384)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha384)::YES
+carol::ip xfrm state::auth-trunc hmac(sha384)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES
diff --git a/testing/tests/ikev1/alg-sha384/posttest.dat b/testing/tests/ikev1/alg-sha384/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/alg-sha384/posttest.dat
+++ b/testing/tests/ikev1/alg-sha384/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/alg-sha384/pretest.dat b/testing/tests/ikev1/alg-sha384/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev1/alg-sha384/pretest.dat
+++ b/testing/tests/ikev1/alg-sha384/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/alg-sha384/test.conf b/testing/tests/ikev1/alg-sha384/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/alg-sha384/test.conf
+++ b/testing/tests/ikev1/alg-sha384/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/alg-sha512/evaltest.dat b/testing/tests/ikev1/alg-sha512/evaltest.dat
index 7b94d2182..6bdceeb44 100644
--- a/testing/tests/ikev1/alg-sha512/evaltest.dat
+++ b/testing/tests/ikev1/alg-sha512/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES
-moon:: ip xfrm state::auth hmac(sha512)::YES
-carol::ip xfrm state::auth hmac(sha512)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha512)::YES
+carol::ip xfrm state::auth-trunc hmac(sha512)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES
diff --git a/testing/tests/ikev1/alg-sha512/posttest.dat b/testing/tests/ikev1/alg-sha512/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/alg-sha512/posttest.dat
+++ b/testing/tests/ikev1/alg-sha512/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/alg-sha512/pretest.dat b/testing/tests/ikev1/alg-sha512/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev1/alg-sha512/pretest.dat
+++ b/testing/tests/ikev1/alg-sha512/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/alg-sha512/test.conf b/testing/tests/ikev1/alg-sha512/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/alg-sha512/test.conf
+++ b/testing/tests/ikev1/alg-sha512/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/compress/pretest.dat b/testing/tests/ikev1/compress/pretest.dat
index 7d077c126..f5aa989fe 100644
--- a/testing/tests/ikev1/compress/pretest.dat
+++ b/testing/tests/ikev1/compress/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
moon::ipsec start
carol::sleep 2
diff --git a/testing/tests/ikev1/compress/test.conf b/testing/tests/ikev1/compress/test.conf
index 6abbb89a9..d7b71426c 100644
--- a/testing/tests/ikev1/compress/test.conf
+++ b/testing/tests/ikev1/compress/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/config-payload/evaltest.dat b/testing/tests/ikev1/config-payload/evaltest.dat
index a429e9b32..b46dfddf6 100644
--- a/testing/tests/ikev1/config-payload/evaltest.dat
+++ b/testing/tests/ikev1/config-payload/evaltest.dat
@@ -5,13 +5,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::cat /etc/resolv.conf::nameserver PH_IP_WINNETOU .*from moon.strongswan.org::YES
carol::cat /etc/resolv.conf::nameserver PH_IP_VENUS .*from moon.strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES
diff --git a/testing/tests/ikev1/config-payload/posttest.dat b/testing/tests/ikev1/config-payload/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/config-payload/posttest.dat
+++ b/testing/tests/ikev1/config-payload/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/config-payload/pretest.dat b/testing/tests/ikev1/config-payload/pretest.dat
index 014e80517..3864bdac3 100644
--- a/testing/tests/ikev1/config-payload/pretest.dat
+++ b/testing/tests/ikev1/config-payload/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev1/config-payload/test.conf b/testing/tests/ikev1/config-payload/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev1/config-payload/test.conf
+++ b/testing/tests/ikev1/config-payload/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/double-nat-net/evaltest.dat b/testing/tests/ikev1/double-nat-net/evaltest.dat
index 05dc82d70..52c561964 100644
--- a/testing/tests/ikev1/double-nat-net/evaltest.dat
+++ b/testing/tests/ikev1/double-nat-net/evaltest.dat
@@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@
bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
-alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
+alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev1/double-nat-net/posttest.dat b/testing/tests/ikev1/double-nat-net/posttest.dat
index 484297418..63d4f98e7 100644
--- a/testing/tests/ikev1/double-nat-net/posttest.dat
+++ b/testing/tests/ikev1/double-nat-net/posttest.dat
@@ -1,7 +1,7 @@
bob::ipsec stop
alice::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-bob::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+bob::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
sun::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/ikev1/double-nat-net/pretest.dat b/testing/tests/ikev1/double-nat-net/pretest.dat
index 41b69aed6..17a4fe5eb 100644
--- a/testing/tests/ikev1/double-nat-net/pretest.dat
+++ b/testing/tests/ikev1/double-nat-net/pretest.dat
@@ -1,8 +1,5 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-bob::/etc/init.d/iptables start 2> /dev/null
-bob::echo 1 > /proc/sys/net/ipv4/ip_forward
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
-sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+bob::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
diff --git a/testing/tests/ikev1/double-nat-net/test.conf b/testing/tests/ikev1/double-nat-net/test.conf
index 1ca2ffe5a..d2e31d257 100644
--- a/testing/tests/ikev1/double-nat-net/test.conf
+++ b/testing/tests/ikev1/double-nat-net/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice bob"
diff --git a/testing/tests/ikev1/double-nat/evaltest.dat b/testing/tests/ikev1/double-nat/evaltest.dat
index b080482f9..9ddad2de5 100644
--- a/testing/tests/ikev1/double-nat/evaltest.dat
+++ b/testing/tests/ikev1/double-nat/evaltest.dat
@@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@
bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules b/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev1/double-nat/hosts/bob/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev1/double-nat/posttest.dat b/testing/tests/ikev1/double-nat/posttest.dat
index 5d39e406d..aa806bfc9 100644
--- a/testing/tests/ikev1/double-nat/posttest.dat
+++ b/testing/tests/ikev1/double-nat/posttest.dat
@@ -1,7 +1,7 @@
bob::ipsec stop
alice::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-bob::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+bob::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
sun::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/ikev1/double-nat/pretest.dat b/testing/tests/ikev1/double-nat/pretest.dat
index 10ba6d735..65f18b756 100644
--- a/testing/tests/ikev1/double-nat/pretest.dat
+++ b/testing/tests/ikev1/double-nat/pretest.dat
@@ -1,7 +1,5 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-bob::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
-sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+bob::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
diff --git a/testing/tests/ikev1/double-nat/test.conf b/testing/tests/ikev1/double-nat/test.conf
index 1ca2ffe5a..d2e31d257 100644
--- a/testing/tests/ikev1/double-nat/test.conf
+++ b/testing/tests/ikev1/double-nat/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice bob"
diff --git a/testing/tests/ikev1/dpd-clear/test.conf b/testing/tests/ikev1/dpd-clear/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev1/dpd-clear/test.conf
+++ b/testing/tests/ikev1/dpd-clear/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/dpd-restart/test.conf b/testing/tests/ikev1/dpd-restart/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev1/dpd-restart/test.conf
+++ b/testing/tests/ikev1/dpd-restart/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/dynamic-initiator/evaltest.dat b/testing/tests/ikev1/dynamic-initiator/evaltest.dat
index f22f1247f..61546f417 100644
--- a/testing/tests/ikev1/dynamic-initiator/evaltest.dat
+++ b/testing/tests/ikev1/dynamic-initiator/evaltest.dat
@@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES
moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES
moon:: cat /var/log/daemon.log::deleting duplicate IKE_SA for.*carol@strongswan.org.*due to uniqueness policy::YES
moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
diff --git a/testing/tests/ikev1/dynamic-initiator/posttest.dat b/testing/tests/ikev1/dynamic-initiator/posttest.dat
index 4dbf3d4a4..32ac12ddc 100644
--- a/testing/tests/ikev1/dynamic-initiator/posttest.dat
+++ b/testing/tests/ikev1/dynamic-initiator/posttest.dat
@@ -2,8 +2,6 @@ dave::ipsec stop
carol::ipsec stop
dave::sleep 1
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+carol::iptables-restore < /etc/iptables.flush
dave::rm /etc/ipsec.d/certs/*
dave::rm /etc/ipsec.d/private/*
diff --git a/testing/tests/ikev1/dynamic-initiator/pretest.dat b/testing/tests/ikev1/dynamic-initiator/pretest.dat
index 92681011f..9aadb2a4c 100644
--- a/testing/tests/ikev1/dynamic-initiator/pretest.dat
+++ b/testing/tests/ikev1/dynamic-initiator/pretest.dat
@@ -1,6 +1,4 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+carol::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
@@ -10,4 +8,4 @@ carol::sleep 1
carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT
carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
dave::ipsec up moon
-dave::sleep 2
+dave::sleep 2
diff --git a/testing/tests/ikev1/dynamic-initiator/test.conf b/testing/tests/ikev1/dynamic-initiator/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev1/dynamic-initiator/test.conf
+++ b/testing/tests/ikev1/dynamic-initiator/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/dynamic-responder/evaltest.dat b/testing/tests/ikev1/dynamic-responder/evaltest.dat
index f22f1247f..61546f417 100644
--- a/testing/tests/ikev1/dynamic-responder/evaltest.dat
+++ b/testing/tests/ikev1/dynamic-responder/evaltest.dat
@@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES
moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES
moon:: cat /var/log/daemon.log::deleting duplicate IKE_SA for.*carol@strongswan.org.*due to uniqueness policy::YES
moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
diff --git a/testing/tests/ikev1/dynamic-responder/posttest.dat b/testing/tests/ikev1/dynamic-responder/posttest.dat
index 4dbf3d4a4..32ac12ddc 100644
--- a/testing/tests/ikev1/dynamic-responder/posttest.dat
+++ b/testing/tests/ikev1/dynamic-responder/posttest.dat
@@ -2,8 +2,6 @@ dave::ipsec stop
carol::ipsec stop
dave::sleep 1
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+carol::iptables-restore < /etc/iptables.flush
dave::rm /etc/ipsec.d/certs/*
dave::rm /etc/ipsec.d/private/*
diff --git a/testing/tests/ikev1/dynamic-responder/pretest.dat b/testing/tests/ikev1/dynamic-responder/pretest.dat
index c0f166ff4..8dc744f9a 100644
--- a/testing/tests/ikev1/dynamic-responder/pretest.dat
+++ b/testing/tests/ikev1/dynamic-responder/pretest.dat
@@ -1,6 +1,4 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+carol::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
@@ -10,4 +8,4 @@ moon::sleep 1
carol::iptables -D INPUT -i eth0 -p udp --dport 500 --sport 500 -j ACCEPT
carol::iptables -D OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
dave::ipsec up moon
-dave::sleep 2
+dave::sleep 2
diff --git a/testing/tests/ikev1/dynamic-responder/test.conf b/testing/tests/ikev1/dynamic-responder/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev1/dynamic-responder/test.conf
+++ b/testing/tests/ikev1/dynamic-responder/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/dynamic-two-peers/evaltest.dat b/testing/tests/ikev1/dynamic-two-peers/evaltest.dat
index 1d5ff68ec..82d2e7318 100644
--- a/testing/tests/ikev1/dynamic-two-peers/evaltest.dat
+++ b/testing/tests/ikev1/dynamic-two-peers/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::dave.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/ikev1/dynamic-two-peers/posttest.dat b/testing/tests/ikev1/dynamic-two-peers/posttest.dat
index e120b87db..7b2609846 100644
--- a/testing/tests/ikev1/dynamic-two-peers/posttest.dat
+++ b/testing/tests/ikev1/dynamic-two-peers/posttest.dat
@@ -3,6 +3,6 @@ dave::ipsec stop
moon::sleep 1
moon::ipsec stop
moon::mv /etc/hosts.ori /etc/hosts
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/dynamic-two-peers/pretest.dat b/testing/tests/ikev1/dynamic-two-peers/pretest.dat
index 6596a2527..4bb2a4686 100644
--- a/testing/tests/ikev1/dynamic-two-peers/pretest.dat
+++ b/testing/tests/ikev1/dynamic-two-peers/pretest.dat
@@ -1,8 +1,8 @@
moon::mv /etc/hosts /etc/hosts.ori
moon::mv /etc/hosts.stale /etc/hosts
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev1/dynamic-two-peers/test.conf b/testing/tests/ikev1/dynamic-two-peers/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev1/dynamic-two-peers/test.conf
+++ b/testing/tests/ikev1/dynamic-two-peers/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat
index 6f7c13704..648920105 100644
--- a/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-ccm/evaltest.dat
@@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::AES_CCM_12_128::YES
carol::ipsec statusall 2> /dev/null::AES_CCM_12_128::YES
carol::ip xfrm state::aead rfc4309(ccm(aes))::YES
diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-ccm/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat b/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-ccm/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/esp-alg-aes-ccm/test.conf b/testing/tests/ikev1/esp-alg-aes-ccm/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/esp-alg-aes-ccm/test.conf
+++ b/testing/tests/ikev1/esp-alg-aes-ccm/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat
index 9a8b46897..c86f58081 100644
--- a/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-ctr/evaltest.dat
@@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::AES_CTR_256/AES_XCBC_96::YES
carol::ipsec statusall 2> /dev/null::AES_CTR_256/AES_XCBC_96::YES
moon:: ip xfrm state::rfc3686(ctr(aes))::YES
diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-ctr/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat b/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-ctr/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/esp-alg-aes-ctr/test.conf b/testing/tests/ikev1/esp-alg-aes-ctr/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/esp-alg-aes-ctr/test.conf
+++ b/testing/tests/ikev1/esp-alg-aes-ctr/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat
index 9d5fb7cc3..a7f52c72e 100644
--- a/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-gcm/evaltest.dat
@@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::AES_GCM_16_256::YES
carol::ipsec statusall 2> /dev/null::AES_GCM_16_256::YES
carol::ip xfrm state::aead rfc4106(gcm(aes))::YES
diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-gcm/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat b/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-gcm/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/esp-alg-aes-gcm/test.conf b/testing/tests/ikev1/esp-alg-aes-gcm/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/esp-alg-aes-gcm/test.conf
+++ b/testing/tests/ikev1/esp-alg-aes-gcm/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat
index 74150fb04..d5d3bc0d3 100644
--- a/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-gmac/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES
carol::ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES
carol::ip xfrm state::aead rfc4543(gcm(aes))::YES
diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-gmac/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat b/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-gmac/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/esp-alg-aes-gmac/test.conf b/testing/tests/ikev1/esp-alg-aes-gmac/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/esp-alg-aes-gmac/test.conf
+++ b/testing/tests/ikev1/esp-alg-aes-gmac/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat b/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat
index 6f5b89332..b466813fe 100644
--- a/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-xcbc/evaltest.dat
@@ -2,10 +2,10 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ipsec statusall 2> /dev/null::AES_CBC_256/AES_XCBC_96,::YES
moon:: ipsec statusall 2> /dev/null::AES_CBC_256/AES_XCBC_96,::YES
-carol::ip xfrm state::auth xcbc(aes)::YES
-moon:: ip xfrm state::auth xcbc(aes)::YES
+carol::ip xfrm state::auth-trunc xcbc(aes)::YES
+moon:: ip xfrm state::auth-trunc xcbc(aes)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat b/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat
index 7d077c126..f5aa989fe 100644
--- a/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-aes-xcbc/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
moon::ipsec start
carol::sleep 2
diff --git a/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf b/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf
index 6abbb89a9..d7b71426c 100644
--- a/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf
+++ b/testing/tests/ikev1/esp-alg-aes-xcbc/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/esp-alg-null/evaltest.dat b/testing/tests/ikev1/esp-alg-null/evaltest.dat
index 937d85ed2..1b9c6c27e 100644
--- a/testing/tests/ikev1/esp-alg-null/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-null/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES
carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES
moon:: ip xfrm state::enc ecb(cipher_null)::YES
diff --git a/testing/tests/ikev1/esp-alg-null/posttest.dat b/testing/tests/ikev1/esp-alg-null/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/esp-alg-null/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-null/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/esp-alg-null/pretest.dat b/testing/tests/ikev1/esp-alg-null/pretest.dat
index 3c3df0196..886fdf55c 100644
--- a/testing/tests/ikev1/esp-alg-null/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-null/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/esp-alg-null/test.conf b/testing/tests/ikev1/esp-alg-null/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/esp-alg-null/test.conf
+++ b/testing/tests/ikev1/esp-alg-null/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/host2host-cert/evaltest.dat b/testing/tests/ikev1/host2host-cert/evaltest.dat
index 53e5589ca..3305f4558 100644
--- a/testing/tests/ikev1/host2host-cert/evaltest.dat
+++ b/testing/tests/ikev1/host2host-cert/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su
sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
-moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/host2host-cert/posttest.dat b/testing/tests/ikev1/host2host-cert/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev1/host2host-cert/posttest.dat
+++ b/testing/tests/ikev1/host2host-cert/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/host2host-cert/pretest.dat b/testing/tests/ikev1/host2host-cert/pretest.dat
index 1fa70177c..3bce9f6e5 100644
--- a/testing/tests/ikev1/host2host-cert/pretest.dat
+++ b/testing/tests/ikev1/host2host-cert/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev1/host2host-cert/test.conf b/testing/tests/ikev1/host2host-cert/test.conf
index 305a67316..55d6e9fd6 100644
--- a/testing/tests/ikev1/host2host-cert/test.conf
+++ b/testing/tests/ikev1/host2host-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev1/host2host-transport/evaltest.dat b/testing/tests/ikev1/host2host-transport/evaltest.dat
index 3021b5e04..fc49e57d8 100644
--- a/testing/tests/ikev1/host2host-transport/evaltest.dat
+++ b/testing/tests/ikev1/host2host-transport/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su
sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
-moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/host2host-transport/posttest.dat b/testing/tests/ikev1/host2host-transport/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev1/host2host-transport/posttest.dat
+++ b/testing/tests/ikev1/host2host-transport/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/host2host-transport/pretest.dat b/testing/tests/ikev1/host2host-transport/pretest.dat
index e2d98f2eb..99789b90f 100644
--- a/testing/tests/ikev1/host2host-transport/pretest.dat
+++ b/testing/tests/ikev1/host2host-transport/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 2
diff --git a/testing/tests/ikev1/host2host-transport/test.conf b/testing/tests/ikev1/host2host-transport/test.conf
index cf2e704fd..5a286c84f 100644
--- a/testing/tests/ikev1/host2host-transport/test.conf
+++ b/testing/tests/ikev1/host2host-transport/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev1/ip-pool-db/evaltest.dat b/testing/tests/ikev1/ip-pool-db/evaltest.dat
index 941cb34c0..42e353084 100644
--- a/testing/tests/ikev1/ip-pool-db/evaltest.dat
+++ b/testing/tests/ikev1/ip-pool-db/evaltest.dat
@@ -6,7 +6,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_VENUS::YES
@@ -15,7 +15,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
diff --git a/testing/tests/ikev1/ip-pool-db/posttest.dat b/testing/tests/ikev1/ip-pool-db/posttest.dat
index 5b88b2163..c99f347e3 100644
--- a/testing/tests/ikev1/ip-pool-db/posttest.dat
+++ b/testing/tests/ikev1/ip-pool-db/posttest.dat
@@ -1,9 +1,9 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::ipsec pool --del bigpool 2> /dev/null
moon::ipsec pool --del dns 2> /dev/null
moon::ipsec pool --del nbns 2> /dev/null
diff --git a/testing/tests/ikev1/ip-pool-db/pretest.dat b/testing/tests/ikev1/ip-pool-db/pretest.dat
index 4a2add194..fce551c69 100644
--- a/testing/tests/ikev1/ip-pool-db/pretest.dat
+++ b/testing/tests/ikev1/ip-pool-db/pretest.dat
@@ -4,9 +4,9 @@ moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2>
moon::ipsec pool --addattr dns --server PH_IP_WINNETOU 2> /dev/null
moon::ipsec pool --addattr dns --server PH_IP_VENUS 2> /dev/null
moon::ipsec pool --addattr nbns --server PH_IP_VENUS 2> /dev/null
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev1/ip-pool-db/test.conf b/testing/tests/ikev1/ip-pool-db/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev1/ip-pool-db/test.conf
+++ b/testing/tests/ikev1/ip-pool-db/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/ip-pool/evaltest.dat b/testing/tests/ikev1/ip-pool/evaltest.dat
index db46646a6..1fdc3f087 100644
--- a/testing/tests/ikev1/ip-pool/evaltest.dat
+++ b/testing/tests/ikev1/ip-pool/evaltest.dat
@@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
diff --git a/testing/tests/ikev1/ip-pool/posttest.dat b/testing/tests/ikev1/ip-pool/posttest.dat
index 1777f439f..b757d8b15 100644
--- a/testing/tests/ikev1/ip-pool/posttest.dat
+++ b/testing/tests/ikev1/ip-pool/posttest.dat
@@ -1,6 +1,6 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/ip-pool/pretest.dat b/testing/tests/ikev1/ip-pool/pretest.dat
index 014e80517..3864bdac3 100644
--- a/testing/tests/ikev1/ip-pool/pretest.dat
+++ b/testing/tests/ikev1/ip-pool/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev1/ip-pool/test.conf b/testing/tests/ikev1/ip-pool/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev1/ip-pool/test.conf
+++ b/testing/tests/ikev1/ip-pool/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat b/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat
index c8e7adcb7..2eebc0f84 100644
--- a/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat
+++ b/testing/tests/ikev1/multi-level-ca-cr-init/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev1/multi-level-ca-cr-init/test.conf b/testing/tests/ikev1/multi-level-ca-cr-init/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev1/multi-level-ca-cr-init/test.conf
+++ b/testing/tests/ikev1/multi-level-ca-cr-init/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat b/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat
index f15265e32..86dd31e83 100644
--- a/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat
+++ b/testing/tests/ikev1/multi-level-ca-cr-resp/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf b/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf
+++ b/testing/tests/ikev1/multi-level-ca-cr-resp/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/multi-level-ca/pretest.dat b/testing/tests/ikev1/multi-level-ca/pretest.dat
index 67c50c2ef..755564cbc 100644
--- a/testing/tests/ikev1/multi-level-ca/pretest.dat
+++ b/testing/tests/ikev1/multi-level-ca/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev1/multi-level-ca/test.conf b/testing/tests/ikev1/multi-level-ca/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev1/multi-level-ca/test.conf
+++ b/testing/tests/ikev1/multi-level-ca/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/nat-rw/evaltest.dat b/testing/tests/ikev1/nat-rw/evaltest.dat
index e0b458dba..387dbae23 100644
--- a/testing/tests/ikev1/nat-rw/evaltest.dat
+++ b/testing/tests/ikev1/nat-rw/evaltest.dat
@@ -6,13 +6,13 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL, ESP in UDP::YES
sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL, ESP in UDP::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
moon:: sleep 6::no output expected::NO
-bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP-encap: ESP::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: isakmp-nat-keep-alive::YES
+bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP-encap: ESP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP-encap: ESP::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: isakmp-nat-keep-alive::YES
alice::cat /var/log/daemon.log::sending keep alive::YES
venus::cat /var/log/daemon.log::sending keep alive::YES
diff --git a/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev1/nat-rw/hosts/sun/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev1/nat-rw/posttest.dat b/testing/tests/ikev1/nat-rw/posttest.dat
index 52572ece8..4643a3a7b 100644
--- a/testing/tests/ikev1/nat-rw/posttest.dat
+++ b/testing/tests/ikev1/nat-rw/posttest.dat
@@ -1,8 +1,8 @@
sun::ipsec stop
alice::ipsec stop
venus::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+venus::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/ikev1/nat-rw/pretest.dat b/testing/tests/ikev1/nat-rw/pretest.dat
index e365ff5c5..d701a1d61 100644
--- a/testing/tests/ikev1/nat-rw/pretest.dat
+++ b/testing/tests/ikev1/nat-rw/pretest.dat
@@ -1,7 +1,6 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+venus::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
alice::ipsec start
diff --git a/testing/tests/ikev1/nat-rw/test.conf b/testing/tests/ikev1/nat-rw/test.conf
index 84317fd70..f515d4bc7 100644
--- a/testing/tests/ikev1/nat-rw/test.conf
+++ b/testing/tests/ikev1/nat-rw/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/ikev1/nat-virtual-ip/description.txt b/testing/tests/ikev1/nat-virtual-ip/description.txt
new file mode 100644
index 000000000..31d24cda6
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/description.txt
@@ -0,0 +1,6 @@
+The router <b>moon</b> sets up a connection to gateway <b>sun</b> in order
+to reach the subnet hidden behind <b>sun</b>. The gateway <b>sun</b> assigns a
+virtual IP address to router <b>moon</b>. A special updown script on <b>moon</b>
+specified by <b>leftupdown=/etc/nat_updown</b> dynamically inserts a source NAT rule
+which maps the IP address of client <b>alice</b> to the virtual IP of <b>moon</b>.
+This allows <b>alice</b> to access client <b>bob</b> via the established IPsec tunnel.
diff --git a/testing/tests/ikev1/nat-virtual-ip/evaltest.dat b/testing/tests/ikev1/nat-virtual-ip/evaltest.dat
new file mode 100644
index 000000000..c60ffc772
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/evaltest.dat
@@ -0,0 +1,8 @@
+moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon:: cat /var/log/daemon.log::inserted NAT rule mapping PH_IP_ALICE to virtual IP::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
+bob::tcpdump::IP alice2.strongswan.org > bob.strongswan.org: ICMP::YES
+bob::tcpdump::IP bob.strongswan.org > alice2.strongswan.org: ICMP::YES
diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts b/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts
new file mode 100644
index 000000000..ee854da09
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/hosts/bob/etc/hosts
@@ -0,0 +1,70 @@
+# /etc/hosts: This file describes a number of hostname-to-address
+# mappings for the TCP/IP subsystem. It is mostly
+# used at boot time, when no name servers are running.
+# On small systems, this file can be used instead of a
+# "named" name server. Just add the names, addresses
+# and any aliases to this file...
+#
+
+127.0.0.1 localhost
+
+192.168.0.254 uml0.strongswan.org uml0
+10.1.0.254 uml1.strongswan.org uml1
+10.2.0.254 uml1.strongswan.org uml2
+
+10.1.0.10 alice.strongswan.org alice
+10.1.0.20 venus.strongswan.org venus
+10.1.0.1 moon1.strongswan.org moon1
+192.168.0.1 moon.strongswan.org moon
+192.168.0.50 alice1.strongswan.org alice1
+192.168.0.100 carol.strongswan.org carol
+10.3.0.1 carol1.strongswan.org carol1
+192.168.0.150 winnetou.strongswan.org winnetou crl.strongswan.org ocsp.strongswan.org ldap.strongswan.org
+192.168.0.200 dave.strongswan.org dave
+10.3.0.2 dave1.strongswan.org dave1
+192.168.0.2 sun.strongswan.org sun
+10.2.0.1 sun1.strongswan.org sun1
+10.2.0.10 bob.strongswan.org bob
+10.4.0.1 alice2.strongswan.org alice2
+
+# IPv6 versions of localhost and co
+::1 ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+# IPv6 solicited-node multicast addresses
+ff02::1:ff00:1 ip6-mcast-1
+ff02::1:ff00:2 ip6-mcast-2
+ff02::1:ff00:10 ip6-mcast-10
+ff02::1:ff00:15 ip6-mcast-15
+ff02::1:ff00:20 ip6-mcast-20
+
+# IPv6 site-local addresses
+fec0::5 ip6-alice1.strongswan.org ip6-alice1
+fec1::10 ip6-alice.strongswan.org ip6-alice
+fec1::20 ip6-venus.strongswan.org ip6-venus
+fec1::1 ip6-moon1.strongswan.org ip6-moon1
+fec0::1 ip6-moon.strongswan.org ip6-moon
+fec0::10 ip6-carol.strongswan.org ip6-carol
+fec3::1 ip6-carol1.strongswan.org ip6-carol1
+fec0::15 ip6-winnetou.strongswan.org ip6-winnetou
+fec0::20 ip6-dave.strongswan.org ip6-dave
+fec3::2 ip6-dave1.strongswan.org ip6-dave1
+fec0::2 ip6-sun.strongswan.org ip6-sun
+fec2::1 ip6-sun1.strongswan.org ip6-sun1
+fec2::10 ip6-bob.strongswan.org ip6-bob
+
+# IPv6 link-local HW derived addresses
+fe80::fcfd:0aff:fe01:14 ip6-hw-venus.strongswan.org ip6-hw-venus
+fe80::fcfd:0aff:fe01:0a ip6-hw-alice.strongswan.org ip6-hw-alice
+fe80::fcfd:0aff:fe01:01 ip6-hw-moon1.strongswan.org ip6-hw-moon1
+fe80::fcfd:c0ff:fea8:01 ip6-hw-moon.strongswan.org ip6-hw-moon
+fe80::fcfd:c0ff:fea8:64 ip6-hw-carol.strongswan.org ip6-hw-carol
+fe80::fcfd:c0ff:fea8:96 ip6-hw-winnetou.strongswan.org ip6-hw-winnetou
+fe80::fcfd:c0ff:fea8:c8 ip6-hw-dave.strongswan.org ip6-hw-dave
+fe80::fcfd:c0ff:fea8:02 ip6-hw-sun.strongswan.org ip6-hw-sun
+fe80::fcfd:0aff:fe02:01 ip6-hw-sun1.strongswan.org ip6-hw-sun1
+fe80::fcfd:0aff:fe02:0a ip6-hw-bob.strongswan.org ip6-hw-bob
diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf
new file mode 100644
index 000000000..28853ce75
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+ keyexchange=ikev1
+ mobike=no
+
+conn net-net
+ left=PH_IP_MOON
+ leftcert=moonCert.pem
+ leftid=@moon.strongswan.org
+ leftsourceip=%config
+ leftupdown=/etc/nat_updown
+ right=PH_IP_SUN
+ rightid=@sun.strongswan.org
+ rightsubnet=10.2.0.0/16
+ auto=add
diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown
new file mode 100755
index 000000000..aab1df687
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/nat_updown
@@ -0,0 +1,152 @@
+#! /bin/sh
+# NAT updown script
+#
+# Copyright (C) 2010 Andreas Steffen <andreas.steffen@strongswan.org>
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at your
+# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+# for more details.
+
+# things that this script gets (from ipsec_pluto(8) man page)
+#
+# PLUTO_VERSION
+# indicates what version of this interface is being
+# used. This document describes version 1.1. This
+# is upwardly compatible with version 1.0.
+#
+# PLUTO_VERB
+# specifies the name of the operation to be performed
+# (prepare-host, prepare-client, up-host, up-client,
+# down-host, or down-client). If the address family
+# for security gateway to security gateway communica-
+# tions is IPv6, then a suffix of -v6 is added to the
+# verb.
+#
+# PLUTO_CONNECTION
+# is the name of the connection for which we are
+# routing.
+#
+# PLUTO_NEXT_HOP
+# is the next hop to which packets bound for the peer
+# must be sent.
+#
+# PLUTO_INTERFACE
+# is the name of the ipsec interface to be used.
+#
+# PLUTO_REQID
+# is the requid of the ESP policy
+#
+# PLUTO_ME
+# is the IP address of our host.
+#
+# PLUTO_MY_ID
+# is the ID of our host.
+#
+# PLUTO_MY_CLIENT
+# is the IP address / count of our client subnet. If
+# the client is just the host, this will be the
+# host's own IP address / max (where max is 32 for
+# IPv4 and 128 for IPv6).
+#
+# PLUTO_MY_CLIENT_NET
+# is the IP address of our client net. If the client
+# is just the host, this will be the host's own IP
+# address.
+#
+# PLUTO_MY_CLIENT_MASK
+# is the mask for our client net. If the client is
+# just the host, this will be 255.255.255.255.
+#
+# PLUTO_MY_SOURCEIP
+# if non-empty, then the source address for the route will be
+# set to this IP address.
+#
+# PLUTO_MY_PROTOCOL
+# is the IP protocol that will be transported.
+#
+# PLUTO_MY_PORT
+# is the UDP/TCP port to which the IPsec SA is
+# restricted on our side.
+#
+# PLUTO_PEER
+# is the IP address of our peer.
+#
+# PLUTO_PEER_ID
+# is the ID of our peer.
+#
+# PLUTO_PEER_CA
+# is the CA which issued the cert of our peer.
+#
+# PLUTO_PEER_CLIENT
+# is the IP address / count of the peer's client sub-
+# net. If the client is just the peer, this will be
+# the peer's own IP address / max (where max is 32
+# for IPv4 and 128 for IPv6).
+#
+# PLUTO_PEER_CLIENT_NET
+# is the IP address of the peer's client net. If the
+# client is just the peer, this will be the peer's
+# own IP address.
+#
+# PLUTO_PEER_CLIENT_MASK
+# is the mask for the peer's client net. If the
+# client is just the peer, this will be
+# 255.255.255.255.
+#
+# PLUTO_PEER_PROTOCOL
+# is the IP protocol that will be transported.
+#
+# PLUTO_PEER_PORT
+# is the UDP/TCP port to which the IPsec SA is
+# restricted on the peer side.
+#
+
+# define a minimum PATH environment in case it is not set
+PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin"
+export PATH
+
+# resolve octal escape sequences
+PLUTO_MY_ID=`printf "$PLUTO_MY_ID"`
+PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"`
+
+case "$PLUTO_VERB:$1" in
+up-host:)
+ # connection to me coming up
+ # If you are doing a custom version, firewall commands go here.
+ ;;
+down-host:)
+ # connection to me going down
+ # If you are doing a custom version, firewall commands go here.
+ ;;
+up-client:)
+ # connection to my client subnet coming up
+ # If you are doing a custom version, firewall commands go here.
+ iptables -A FORWARD -i eth1 -o $PLUTO_INTERFACE -s PH_IP_ALICE \
+ -d $PLUTO_PEER_CLIENT -j ACCEPT
+ iptables -A FORWARD -o eth1 -i $PLUTO_INTERFACE -d PH_IP_ALICE \
+ -s $PLUTO_PEER_CLIENT -j ACCEPT
+ iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -s PH_IP_ALICE \
+ -d $PLUTO_PEER_CLIENT -j SNAT --to-source $PLUTO_MY_SOURCEIP
+ echo "inserted NAT rule mapping PH_IP_ALICE to virtual IP $PLUTO_MY_SOURCEIP" >&2
+ ;;
+down-client:)
+ # connection to my client subnet going down
+ # If you are doing a custom version, firewall commands go here.
+ iptables -D FORWARD -i eth1 -o $PLUTO_INTERFACE -s PH_IP_ALICE \
+ -d $PLUTO_PEER_CLIENT -j ACCEPT
+ iptables -D FORWARD -o eth1 -i $PLUTO_INTERFACE -d PH_IP_ALICE \
+ -s $PLUTO_PEER_CLIENT -j ACCEPT
+ iptables -t nat -D POSTROUTING -o $PLUTO_INTERFACE -s PH_IP_ALICE \
+ -d $PLUTO_PEER_CLIENT -j SNAT --to-source $PLUTO_MY_SOURCEIP
+ echo "deleted NAT rule mapping PH_IP_ALICE to virtual IP $PLUTO_MY_SOURCEIP" >&2
+ ;;
+*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
+ exit 1
+ ;;
+esac
diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf
new file mode 100644
index 000000000..8e685c862
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/hosts/moon/etc/strongswan.conf
@@ -0,0 +1,6 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
+ multiple_authentication = no
+}
diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf
new file mode 100644
index 000000000..ff030b5b5
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+ keyexchange=ikev1
+ mobike=no
+
+conn net-net
+ left=PH_IP_SUN
+ leftcert=sunCert.pem
+ leftid=@sun.strongswan.org
+ leftsubnet=10.2.0.0/16
+ leftfirewall=yes
+ right=PH_IP_MOON
+ rightid=@moon.strongswan.org
+ rightsourceip=10.4.0.0/24
+ auto=add
diff --git a/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf
new file mode 100644
index 000000000..8e685c862
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/hosts/sun/etc/strongswan.conf
@@ -0,0 +1,6 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
+ multiple_authentication = no
+}
diff --git a/testing/tests/ikev1/nat-virtual-ip/posttest.dat b/testing/tests/ikev1/nat-virtual-ip/posttest.dat
new file mode 100644
index 000000000..11bd19da7
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/posttest.dat
@@ -0,0 +1,6 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::conntrack -F
+moon::rm /etc/nat_updown
diff --git a/testing/tests/ikev1/nat-virtual-ip/pretest.dat b/testing/tests/ikev1/nat-virtual-ip/pretest.dat
new file mode 100644
index 000000000..eb0c28c7f
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/pretest.dat
@@ -0,0 +1,8 @@
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
+moon::conntrack -F
+moon::ipsec start
+sun::ipsec start
+moon::sleep 1
+moon::ipsec up net-net
+moon::sleep 1
diff --git a/testing/tests/ikev1/nat-virtual-ip/test.conf b/testing/tests/ikev1/nat-virtual-ip/test.conf
new file mode 100644
index 000000000..f46f137b4
--- /dev/null
+++ b/testing/tests/ikev1/nat-virtual-ip/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun bob"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev1/net2net-cert/evaltest.dat b/testing/tests/ikev1/net2net-cert/evaltest.dat
index c98f5d78d..2b37cad99 100644
--- a/testing/tests/ikev1/net2net-cert/evaltest.dat
+++ b/testing/tests/ikev1/net2net-cert/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/net2net-cert/posttest.dat b/testing/tests/ikev1/net2net-cert/posttest.dat
index a4c96e10f..837738fc6 100644
--- a/testing/tests/ikev1/net2net-cert/posttest.dat
+++ b/testing/tests/ikev1/net2net-cert/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/net2net-cert/pretest.dat b/testing/tests/ikev1/net2net-cert/pretest.dat
index 2d7a78acb..c724e5df8 100644
--- a/testing/tests/ikev1/net2net-cert/pretest.dat
+++ b/testing/tests/ikev1/net2net-cert/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev1/net2net-cert/test.conf b/testing/tests/ikev1/net2net-cert/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/ikev1/net2net-cert/test.conf
+++ b/testing/tests/ikev1/net2net-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev1/net2net-psk-fail/posttest.dat b/testing/tests/ikev1/net2net-psk-fail/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev1/net2net-psk-fail/posttest.dat
+++ b/testing/tests/ikev1/net2net-psk-fail/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/net2net-psk-fail/pretest.dat b/testing/tests/ikev1/net2net-psk-fail/pretest.dat
index 9e40684ab..0f4ae0f4f 100644
--- a/testing/tests/ikev1/net2net-psk-fail/pretest.dat
+++ b/testing/tests/ikev1/net2net-psk-fail/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
diff --git a/testing/tests/ikev1/net2net-psk-fail/test.conf b/testing/tests/ikev1/net2net-psk-fail/test.conf
index f6e064e7d..eb4822b5d 100644
--- a/testing/tests/ikev1/net2net-psk-fail/test.conf
+++ b/testing/tests/ikev1/net2net-psk-fail/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev1/net2net-psk/evaltest.dat b/testing/tests/ikev1/net2net-psk/evaltest.dat
index c98f5d78d..2b37cad99 100644
--- a/testing/tests/ikev1/net2net-psk/evaltest.dat
+++ b/testing/tests/ikev1/net2net-psk/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/net2net-psk/posttest.dat b/testing/tests/ikev1/net2net-psk/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev1/net2net-psk/posttest.dat
+++ b/testing/tests/ikev1/net2net-psk/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/net2net-psk/pretest.dat b/testing/tests/ikev1/net2net-psk/pretest.dat
index 9e40684ab..0f4ae0f4f 100644
--- a/testing/tests/ikev1/net2net-psk/pretest.dat
+++ b/testing/tests/ikev1/net2net-psk/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
diff --git a/testing/tests/ikev1/net2net-psk/test.conf b/testing/tests/ikev1/net2net-psk/test.conf
index f74d0f7d6..afa2accbe 100644
--- a/testing/tests/ikev1/net2net-psk/test.conf
+++ b/testing/tests/ikev1/net2net-psk/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev1/protoport-dual/evaltest.dat b/testing/tests/ikev1/protoport-dual/evaltest.dat
index a65460cc8..cf45f3b52 100644
--- a/testing/tests/ikev1/protoport-dual/evaltest.dat
+++ b/testing/tests/ikev1/protoport-dual/evaltest.dat
@@ -2,8 +2,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/protoport-dual/posttest.dat b/testing/tests/ikev1/protoport-dual/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev1/protoport-dual/posttest.dat
+++ b/testing/tests/ikev1/protoport-dual/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/protoport-dual/pretest.dat b/testing/tests/ikev1/protoport-dual/pretest.dat
index d3d0061c3..efb2e5712 100644
--- a/testing/tests/ikev1/protoport-dual/pretest.dat
+++ b/testing/tests/ikev1/protoport-dual/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 2
diff --git a/testing/tests/ikev1/protoport-dual/test.conf b/testing/tests/ikev1/protoport-dual/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev1/protoport-dual/test.conf
+++ b/testing/tests/ikev1/protoport-dual/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat b/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat
index f8cfb111b..ba661975b 100644
--- a/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat
+++ b/testing/tests/ikev1/rw-cert-aggressive/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/rw-cert-aggressive/posttest.dat b/testing/tests/ikev1/rw-cert-aggressive/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/rw-cert-aggressive/posttest.dat
+++ b/testing/tests/ikev1/rw-cert-aggressive/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/rw-cert-aggressive/pretest.dat b/testing/tests/ikev1/rw-cert-aggressive/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev1/rw-cert-aggressive/pretest.dat
+++ b/testing/tests/ikev1/rw-cert-aggressive/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev1/rw-cert-aggressive/test.conf b/testing/tests/ikev1/rw-cert-aggressive/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/rw-cert-aggressive/test.conf
+++ b/testing/tests/ikev1/rw-cert-aggressive/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/rw-cert-unity/evaltest.dat b/testing/tests/ikev1/rw-cert-unity/evaltest.dat
index b6a860b86..c183f48e9 100644
--- a/testing/tests/ikev1/rw-cert-unity/evaltest.dat
+++ b/testing/tests/ikev1/rw-cert-unity/evaltest.dat
@@ -3,6 +3,6 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro
carol::ipsec status 2> /dev/null::10.2.1.1/32 === 192.168.0.0/24 PASS::YES
carol::ipsec status 2> /dev/null::home.*10.2.1.1/32 === 10.1.0.0/16 10.2.1.0/24::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 10.2.1.0/24 === 10.2.1.1/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/rw-cert-unity/test.conf b/testing/tests/ikev1/rw-cert-unity/test.conf
index 25cff970f..09e6f6cdb 100644
--- a/testing/tests/ikev1/rw-cert-unity/test.conf
+++ b/testing/tests/ikev1/rw-cert-unity/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev1/rw-cert/evaltest.dat b/testing/tests/ikev1/rw-cert/evaltest.dat
index f8cfb111b..ba661975b 100644
--- a/testing/tests/ikev1/rw-cert/evaltest.dat
+++ b/testing/tests/ikev1/rw-cert/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/rw-cert/posttest.dat b/testing/tests/ikev1/rw-cert/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/rw-cert/posttest.dat
+++ b/testing/tests/ikev1/rw-cert/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/rw-cert/pretest.dat b/testing/tests/ikev1/rw-cert/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev1/rw-cert/pretest.dat
+++ b/testing/tests/ikev1/rw-cert/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev1/rw-cert/test.conf b/testing/tests/ikev1/rw-cert/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/rw-cert/test.conf
+++ b/testing/tests/ikev1/rw-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat b/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat
index b545c2289..2342d024b 100644
--- a/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat
+++ b/testing/tests/ikev1/rw-psk-aggressive/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/rw-psk-aggressive/posttest.dat b/testing/tests/ikev1/rw-psk-aggressive/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/rw-psk-aggressive/posttest.dat
+++ b/testing/tests/ikev1/rw-psk-aggressive/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/rw-psk-aggressive/pretest.dat b/testing/tests/ikev1/rw-psk-aggressive/pretest.dat
index 761abe274..44f41f995 100644
--- a/testing/tests/ikev1/rw-psk-aggressive/pretest.dat
+++ b/testing/tests/ikev1/rw-psk-aggressive/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev1/rw-psk-aggressive/test.conf b/testing/tests/ikev1/rw-psk-aggressive/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/rw-psk-aggressive/test.conf
+++ b/testing/tests/ikev1/rw-psk-aggressive/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat
index ef964a234..77f548848 100644
--- a/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat
+++ b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-dave.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat
+++ b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/rw-psk-fqdn/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat
index 761abe274..44f41f995 100644
--- a/testing/tests/ikev1/rw-psk-fqdn/pretest.dat
+++ b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev1/rw-psk-fqdn/test.conf b/testing/tests/ikev1/rw-psk-fqdn/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/rw-psk-fqdn/test.conf
+++ b/testing/tests/ikev1/rw-psk-fqdn/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat
index d56c5220f..df37719e9 100644
--- a/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat
+++ b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-dave.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat
+++ b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/rw-psk-ipv4/pretest.dat b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat
index 761abe274..44f41f995 100644
--- a/testing/tests/ikev1/rw-psk-ipv4/pretest.dat
+++ b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev1/rw-psk-ipv4/test.conf b/testing/tests/ikev1/rw-psk-ipv4/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/rw-psk-ipv4/test.conf
+++ b/testing/tests/ikev1/rw-psk-ipv4/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/virtual-ip/evaltest.dat b/testing/tests/ikev1/virtual-ip/evaltest.dat
index dd3143ae7..0f5df71d7 100644
--- a/testing/tests/ikev1/virtual-ip/evaltest.dat
+++ b/testing/tests/ikev1/virtual-ip/evaltest.dat
@@ -14,12 +14,12 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::src PH_IP_CAROL1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::src PH_IP_DAVE1::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/virtual-ip/posttest.dat b/testing/tests/ikev1/virtual-ip/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/virtual-ip/posttest.dat
+++ b/testing/tests/ikev1/virtual-ip/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/virtual-ip/pretest.dat b/testing/tests/ikev1/virtual-ip/pretest.dat
index 5ec37aae1..1765a83cd 100644
--- a/testing/tests/ikev1/virtual-ip/pretest.dat
+++ b/testing/tests/ikev1/virtual-ip/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev1/virtual-ip/test.conf b/testing/tests/ikev1/virtual-ip/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev1/virtual-ip/test.conf
+++ b/testing/tests/ikev1/virtual-ip/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat b/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat
index 02ed911ba..cd4ebd8ec 100644
--- a/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat
+++ b/testing/tests/ikev1/xauth-id-psk-config/evaltest.dat
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer.*carol::YE
moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.2 to peer.*dave::YES
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/xauth-id-psk-config/posttest.dat b/testing/tests/ikev1/xauth-id-psk-config/posttest.dat
index 1777f439f..b757d8b15 100644
--- a/testing/tests/ikev1/xauth-id-psk-config/posttest.dat
+++ b/testing/tests/ikev1/xauth-id-psk-config/posttest.dat
@@ -1,6 +1,6 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/xauth-id-psk-config/pretest.dat b/testing/tests/ikev1/xauth-id-psk-config/pretest.dat
index 95a6be131..88a91ae86 100644
--- a/testing/tests/ikev1/xauth-id-psk-config/pretest.dat
+++ b/testing/tests/ikev1/xauth-id-psk-config/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev1/xauth-id-psk-config/test.conf b/testing/tests/ikev1/xauth-id-psk-config/test.conf
index 75510b295..9b1ec0b54 100644
--- a/testing/tests/ikev1/xauth-id-psk-config/test.conf
+++ b/testing/tests/ikev1/xauth-id-psk-config/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat
index 5b021a09a..34c124c95 100644
--- a/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/evaltest.dat
@@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
moon:: cat /var/log/daemon.log::XAuth authentication of.*carol.*successful::YES
moon:: cat /var/log/daemon.log::XAuth authentication of.*dave.*successful::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat
index 78e2d57f8..e5a06d44c 100644
--- a/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf b/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf
+++ b/testing/tests/ikev1/xauth-id-rsa-aggressive/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat
index 198dd3782..7604a1527 100644
--- a/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-config/evaltest.dat
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.1 to peer.*carol::YE
moon:: cat /var/log/daemon.log::assigning virtual IP 10.3.0.2 to peer.*dave::YES
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP 10.3.0.2::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-config/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat
index 78e2d57f8..e5a06d44c 100644
--- a/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-config/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev1/xauth-id-rsa-config/test.conf b/testing/tests/ikev1/xauth-id-rsa-config/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/xauth-id-rsa-config/test.conf
+++ b/testing/tests/ikev1/xauth-id-rsa-config/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat
index 5b021a09a..34c124c95 100644
--- a/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/evaltest.dat
@@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
moon:: cat /var/log/daemon.log::XAuth authentication of.*carol.*successful::YES
moon:: cat /var/log/daemon.log::XAuth authentication of.*dave.*successful::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat b/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat
index 78e2d57f8..e5a06d44c 100644
--- a/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat
+++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf b/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf
+++ b/testing/tests/ikev1/xauth-id-rsa-hybrid/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/xauth-psk/evaltest.dat b/testing/tests/ikev1/xauth-psk/evaltest.dat
index 988a6c541..c6637cbfe 100644
--- a/testing/tests/ikev1/xauth-psk/evaltest.dat
+++ b/testing/tests/ikev1/xauth-psk/evaltest.dat
@@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
moon:: cat /var/log/daemon.log::XAuth authentication of.*carol@strongswan.org.*successful::YES
moon:: cat /var/log/daemon.log::XAuth authentication of.*dave@strongswan.org.*successful::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/xauth-psk/posttest.dat b/testing/tests/ikev1/xauth-psk/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/xauth-psk/posttest.dat
+++ b/testing/tests/ikev1/xauth-psk/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/xauth-psk/pretest.dat b/testing/tests/ikev1/xauth-psk/pretest.dat
index 95a6be131..88a91ae86 100644
--- a/testing/tests/ikev1/xauth-psk/pretest.dat
+++ b/testing/tests/ikev1/xauth-psk/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev1/xauth-psk/test.conf b/testing/tests/ikev1/xauth-psk/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/xauth-psk/test.conf
+++ b/testing/tests/ikev1/xauth-psk/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat
index 0591e22b6..d568273d1 100644
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/evaltest.dat
@@ -5,6 +5,6 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf
index 623f42904..623f42904 100644
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default
index 802fcfd8d..dd0825858 100644
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -41,4 +41,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/users
index 4fb07b912..4fb07b912 100644
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index 1143a0473..000000000
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,120 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat
index 920d6a20d..181949fb5 100644
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
carol::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat
index 280d62e3c..9adc43d3e 100644
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+alice::radiusd
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf
index e0d77b583..eb1e15dd2 100644
--- a/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf
+++ b/testing/tests/ikev1/xauth-rsa-eap-md5-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev1/xauth-rsa/evaltest.dat b/testing/tests/ikev1/xauth-rsa/evaltest.dat
index 988a6c541..c6637cbfe 100644
--- a/testing/tests/ikev1/xauth-rsa/evaltest.dat
+++ b/testing/tests/ikev1/xauth-rsa/evaltest.dat
@@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
moon:: cat /var/log/daemon.log::XAuth authentication of.*carol@strongswan.org.*successful::YES
moon:: cat /var/log/daemon.log::XAuth authentication of.*dave@strongswan.org.*successful::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev1/xauth-rsa/posttest.dat b/testing/tests/ikev1/xauth-rsa/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev1/xauth-rsa/posttest.dat
+++ b/testing/tests/ikev1/xauth-rsa/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev1/xauth-rsa/pretest.dat b/testing/tests/ikev1/xauth-rsa/pretest.dat
index 78e2d57f8..e5a06d44c 100644
--- a/testing/tests/ikev1/xauth-rsa/pretest.dat
+++ b/testing/tests/ikev1/xauth-rsa/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev1/xauth-rsa/test.conf b/testing/tests/ikev1/xauth-rsa/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev1/xauth-rsa/test.conf
+++ b/testing/tests/ikev1/xauth-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/after-2038-certs/evaltest.dat b/testing/tests/ikev2/after-2038-certs/evaltest.dat
index 3efaa5a98..427aa74da 100644
--- a/testing/tests/ikev2/after-2038-certs/evaltest.dat
+++ b/testing/tests/ikev2/after-2038-certs/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/after-2038-certs/posttest.dat b/testing/tests/ikev2/after-2038-certs/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/after-2038-certs/posttest.dat
+++ b/testing/tests/ikev2/after-2038-certs/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/after-2038-certs/pretest.dat b/testing/tests/ikev2/after-2038-certs/pretest.dat
index 4921d5097..baacc1605 100644
--- a/testing/tests/ikev2/after-2038-certs/pretest.dat
+++ b/testing/tests/ikev2/after-2038-certs/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/after-2038-certs/test.conf b/testing/tests/ikev2/after-2038-certs/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/after-2038-certs/test.conf
+++ b/testing/tests/ikev2/after-2038-certs/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-3des-md5/evaltest.dat b/testing/tests/ikev2/alg-3des-md5/evaltest.dat
index a553ff168..abd29e97e 100644
--- a/testing/tests/ikev2/alg-3des-md5/evaltest.dat
+++ b/testing/tests/ikev2/alg-3des-md5/evaltest.dat
@@ -4,12 +4,12 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*3DES_CBC/HMAC_MD5_96,::YES
carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_MD5_96,::YES
moon:: ip xfrm state::enc cbc(des3_ede)::YES
carol::ip xfrm state::enc cbc(des3_ede)::YES
-moon:: ip xfrm state::auth hmac(md5)::YES
-carol::ip xfrm state::auth hmac(md5)::YES
+moon:: ip xfrm state::auth-trunc hmac(md5)::YES
+carol::ip xfrm state::auth-trunc hmac(md5)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 180::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 180::YES
diff --git a/testing/tests/ikev2/alg-3des-md5/posttest.dat b/testing/tests/ikev2/alg-3des-md5/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-3des-md5/posttest.dat
+++ b/testing/tests/ikev2/alg-3des-md5/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-3des-md5/pretest.dat b/testing/tests/ikev2/alg-3des-md5/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-3des-md5/pretest.dat
+++ b/testing/tests/ikev2/alg-3des-md5/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-3des-md5/test.conf b/testing/tests/ikev2/alg-3des-md5/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/alg-3des-md5/test.conf
+++ b/testing/tests/ikev2/alg-3des-md5/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-aes-ccm/evaltest.dat b/testing/tests/ikev2/alg-aes-ccm/evaltest.dat
index e2cf773ea..5a14b98d6 100644
--- a/testing/tests/ikev2/alg-aes-ccm/evaltest.dat
+++ b/testing/tests/ikev2/alg-aes-ccm/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_CCM_12_128::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: AES_CCM_12_128::YES
moon:: ipsec statusall 2> /dev/null::AES_CCM_12_128,::YES
diff --git a/testing/tests/ikev2/alg-aes-ccm/posttest.dat b/testing/tests/ikev2/alg-aes-ccm/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-aes-ccm/posttest.dat
+++ b/testing/tests/ikev2/alg-aes-ccm/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-aes-ccm/pretest.dat b/testing/tests/ikev2/alg-aes-ccm/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-aes-ccm/pretest.dat
+++ b/testing/tests/ikev2/alg-aes-ccm/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-aes-ccm/test.conf b/testing/tests/ikev2/alg-aes-ccm/test.conf
index acb73b06f..11423f723 100644
--- a/testing/tests/ikev2/alg-aes-ccm/test.conf
+++ b/testing/tests/ikev2/alg-aes-ccm/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-aes-ctr/evaltest.dat b/testing/tests/ikev2/alg-aes-ctr/evaltest.dat
index 177e0ea62..6a5203a2d 100644
--- a/testing/tests/ikev2/alg-aes-ctr/evaltest.dat
+++ b/testing/tests/ikev2/alg-aes-ctr/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_CTR_128::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: AES_CTR_128::YES
moon:: ipsec statusall 2> /dev/null::AES_CTR_128/AES_XCBC_96,::YES
diff --git a/testing/tests/ikev2/alg-aes-ctr/posttest.dat b/testing/tests/ikev2/alg-aes-ctr/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-aes-ctr/posttest.dat
+++ b/testing/tests/ikev2/alg-aes-ctr/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-aes-ctr/pretest.dat b/testing/tests/ikev2/alg-aes-ctr/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-aes-ctr/pretest.dat
+++ b/testing/tests/ikev2/alg-aes-ctr/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-aes-ctr/test.conf b/testing/tests/ikev2/alg-aes-ctr/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/alg-aes-ctr/test.conf
+++ b/testing/tests/ikev2/alg-aes-ctr/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-aes-gcm/evaltest.dat b/testing/tests/ikev2/alg-aes-gcm/evaltest.dat
index 39f8b1cc4..ce27fcc05 100644
--- a/testing/tests/ikev2/alg-aes-gcm/evaltest.dat
+++ b/testing/tests/ikev2/alg-aes-gcm/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: AES_GCM_16_256::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: AES_GCM_16_256::YES
moon:: ipsec statusall 2> /dev/null::AES_GCM_16_256,::YES
diff --git a/testing/tests/ikev2/alg-aes-gcm/posttest.dat b/testing/tests/ikev2/alg-aes-gcm/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-aes-gcm/posttest.dat
+++ b/testing/tests/ikev2/alg-aes-gcm/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-aes-gcm/pretest.dat b/testing/tests/ikev2/alg-aes-gcm/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-aes-gcm/pretest.dat
+++ b/testing/tests/ikev2/alg-aes-gcm/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-aes-gcm/test.conf b/testing/tests/ikev2/alg-aes-gcm/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/alg-aes-gcm/test.conf
+++ b/testing/tests/ikev2/alg-aes-gcm/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat b/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat
index 7a9874528..f11018347 100644
--- a/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat
+++ b/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat
@@ -4,11 +4,11 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES
-moon:: ip xfrm state::auth xcbc(aes)::YES
-carol::ip xfrm state::auth xcbc(aes)::YES
+moon:: ip xfrm state::auth-trunc xcbc(aes)::YES
+carol::ip xfrm state::auth-trunc xcbc(aes)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
diff --git a/testing/tests/ikev2/alg-aes-xcbc/posttest.dat b/testing/tests/ikev2/alg-aes-xcbc/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-aes-xcbc/posttest.dat
+++ b/testing/tests/ikev2/alg-aes-xcbc/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-aes-xcbc/pretest.dat b/testing/tests/ikev2/alg-aes-xcbc/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-aes-xcbc/pretest.dat
+++ b/testing/tests/ikev2/alg-aes-xcbc/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-aes-xcbc/test.conf b/testing/tests/ikev2/alg-aes-xcbc/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/alg-aes-xcbc/test.conf
+++ b/testing/tests/ikev2/alg-aes-xcbc/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-blowfish/evaltest.dat b/testing/tests/ikev2/alg-blowfish/evaltest.dat
index a458f0241..f76522c5c 100644
--- a/testing/tests/ikev2/alg-blowfish/evaltest.dat
+++ b/testing/tests/ikev2/alg-blowfish/evaltest.dat
@@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES
dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_256_128,::YES
dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA1_96,::YES
carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES
diff --git a/testing/tests/ikev2/alg-blowfish/posttest.dat b/testing/tests/ikev2/alg-blowfish/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/alg-blowfish/posttest.dat
+++ b/testing/tests/ikev2/alg-blowfish/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-blowfish/pretest.dat b/testing/tests/ikev2/alg-blowfish/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev2/alg-blowfish/pretest.dat
+++ b/testing/tests/ikev2/alg-blowfish/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/alg-blowfish/test.conf b/testing/tests/ikev2/alg-blowfish/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/alg-blowfish/test.conf
+++ b/testing/tests/ikev2/alg-blowfish/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat b/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat
index 0acd6d2ce..5e4ab98b3 100644
--- a/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat
+++ b/testing/tests/ikev2/alg-modp-subgroup/evaltest.dat
@@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::DH group MODP_2048_224.*MODP_1024_160::YES
dave:: cat /var/log/daemon.log::DH group MODP_2048_224.*MODP_2048_256::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024_160::YES
dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048_256::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/alg-modp-subgroup/posttest.dat b/testing/tests/ikev2/alg-modp-subgroup/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/alg-modp-subgroup/posttest.dat
+++ b/testing/tests/ikev2/alg-modp-subgroup/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-modp-subgroup/pretest.dat b/testing/tests/ikev2/alg-modp-subgroup/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev2/alg-modp-subgroup/pretest.dat
+++ b/testing/tests/ikev2/alg-modp-subgroup/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/alg-modp-subgroup/test.conf b/testing/tests/ikev2/alg-modp-subgroup/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/alg-modp-subgroup/test.conf
+++ b/testing/tests/ikev2/alg-modp-subgroup/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/alg-sha256-96/evaltest.dat b/testing/tests/ikev2/alg-sha256-96/evaltest.dat
index 4bbc82d9b..6c4e23710 100644
--- a/testing/tests/ikev2/alg-sha256-96/evaltest.dat
+++ b/testing/tests/ikev2/alg-sha256-96/evaltest.dat
@@ -6,10 +6,10 @@ moon:: cat /var/log/daemon.log::received strongSwan vendor ID::YES
carol::cat /var/log/daemon.log::received strongSwan vendor ID::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_96,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_96,::YES
-moon:: ip xfrm state::auth hmac(sha256)::YES
-carol::ip xfrm state::auth hmac(sha256)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha256)::YES
+carol::ip xfrm state::auth-trunc hmac(sha256)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
diff --git a/testing/tests/ikev2/alg-sha256-96/posttest.dat b/testing/tests/ikev2/alg-sha256-96/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-sha256-96/posttest.dat
+++ b/testing/tests/ikev2/alg-sha256-96/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-sha256-96/pretest.dat b/testing/tests/ikev2/alg-sha256-96/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-sha256-96/pretest.dat
+++ b/testing/tests/ikev2/alg-sha256-96/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-sha256-96/test.conf b/testing/tests/ikev2/alg-sha256-96/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/alg-sha256-96/test.conf
+++ b/testing/tests/ikev2/alg-sha256-96/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-sha256/evaltest.dat b/testing/tests/ikev2/alg-sha256/evaltest.dat
index 7b5640af8..eba856742 100644
--- a/testing/tests/ikev2/alg-sha256/evaltest.dat
+++ b/testing/tests/ikev2/alg-sha256/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_128,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128,::YES
-moon:: ip xfrm state::auth hmac(sha256)::YES
-carol::ip xfrm state::auth hmac(sha256)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha256)::YES
+carol::ip xfrm state::auth-trunc hmac(sha256)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 200::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 200::YES
diff --git a/testing/tests/ikev2/alg-sha256/posttest.dat b/testing/tests/ikev2/alg-sha256/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-sha256/posttest.dat
+++ b/testing/tests/ikev2/alg-sha256/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-sha256/pretest.dat b/testing/tests/ikev2/alg-sha256/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-sha256/pretest.dat
+++ b/testing/tests/ikev2/alg-sha256/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-sha256/test.conf b/testing/tests/ikev2/alg-sha256/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/alg-sha256/test.conf
+++ b/testing/tests/ikev2/alg-sha256/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-sha384/evaltest.dat b/testing/tests/ikev2/alg-sha384/evaltest.dat
index 21b3d5a4f..3b24217c5 100644
--- a/testing/tests/ikev2/alg-sha384/evaltest.dat
+++ b/testing/tests/ikev2/alg-sha384/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES
-moon:: ip xfrm state::auth hmac(sha384)::YES
-carol::ip xfrm state::auth hmac(sha384)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha384)::YES
+carol::ip xfrm state::auth-trunc hmac(sha384)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES
diff --git a/testing/tests/ikev2/alg-sha384/posttest.dat b/testing/tests/ikev2/alg-sha384/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-sha384/posttest.dat
+++ b/testing/tests/ikev2/alg-sha384/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-sha384/pretest.dat b/testing/tests/ikev2/alg-sha384/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-sha384/pretest.dat
+++ b/testing/tests/ikev2/alg-sha384/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-sha384/test.conf b/testing/tests/ikev2/alg-sha384/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/alg-sha384/test.conf
+++ b/testing/tests/ikev2/alg-sha384/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/alg-sha512/evaltest.dat b/testing/tests/ikev2/alg-sha512/evaltest.dat
index 7b94d2182..6bdceeb44 100644
--- a/testing/tests/ikev2/alg-sha512/evaltest.dat
+++ b/testing/tests/ikev2/alg-sha512/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES
-moon:: ip xfrm state::auth hmac(sha512)::YES
-carol::ip xfrm state::auth hmac(sha512)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha512)::YES
+carol::ip xfrm state::auth-trunc hmac(sha512)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES
diff --git a/testing/tests/ikev2/alg-sha512/posttest.dat b/testing/tests/ikev2/alg-sha512/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/alg-sha512/posttest.dat
+++ b/testing/tests/ikev2/alg-sha512/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/alg-sha512/pretest.dat b/testing/tests/ikev2/alg-sha512/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/alg-sha512/pretest.dat
+++ b/testing/tests/ikev2/alg-sha512/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/alg-sha512/test.conf b/testing/tests/ikev2/alg-sha512/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/alg-sha512/test.conf
+++ b/testing/tests/ikev2/alg-sha512/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/any-interface/pretest.dat b/testing/tests/ikev2/any-interface/pretest.dat
index b8e91194e..0a6ce8be4 100644
--- a/testing/tests/ikev2/any-interface/pretest.dat
+++ b/testing/tests/ikev2/any-interface/pretest.dat
@@ -1,5 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
-sun::echo 1 > /proc/sys/net/ipv4/ip_forward
winnetou::ip route add 10.1.0.0/16 via PH_IP_MOON
winnetou::ip route add 10.2.0.0/16 via PH_IP_SUN
alice::ipsec start
diff --git a/testing/tests/ikev2/any-interface/test.conf b/testing/tests/ikev2/any-interface/test.conf
index 25e5cd872..cc04d45e6 100644
--- a/testing/tests/ikev2/any-interface/test.conf
+++ b/testing/tests/ikev2/any-interface/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice sun bob"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice moon sun bob"
diff --git a/testing/tests/ikev2/compress/pretest.dat b/testing/tests/ikev2/compress/pretest.dat
index 7d077c126..f5aa989fe 100644
--- a/testing/tests/ikev2/compress/pretest.dat
+++ b/testing/tests/ikev2/compress/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
moon::ipsec start
carol::sleep 2
diff --git a/testing/tests/ikev2/compress/test.conf b/testing/tests/ikev2/compress/test.conf
index 6abbb89a9..d7b71426c 100644
--- a/testing/tests/ikev2/compress/test.conf
+++ b/testing/tests/ikev2/compress/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/config-payload-swapped/evaltest.dat b/testing/tests/ikev2/config-payload-swapped/evaltest.dat
index 3c41a596c..b6a1c96a6 100644
--- a/testing/tests/ikev2/config-payload-swapped/evaltest.dat
+++ b/testing/tests/ikev2/config-payload-swapped/evaltest.dat
@@ -3,13 +3,13 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES
carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES
diff --git a/testing/tests/ikev2/config-payload-swapped/posttest.dat b/testing/tests/ikev2/config-payload-swapped/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/config-payload-swapped/posttest.dat
+++ b/testing/tests/ikev2/config-payload-swapped/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/config-payload-swapped/pretest.dat b/testing/tests/ikev2/config-payload-swapped/pretest.dat
index 014e80517..3864bdac3 100644
--- a/testing/tests/ikev2/config-payload-swapped/pretest.dat
+++ b/testing/tests/ikev2/config-payload-swapped/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/config-payload-swapped/test.conf b/testing/tests/ikev2/config-payload-swapped/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/config-payload-swapped/test.conf
+++ b/testing/tests/ikev2/config-payload-swapped/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/config-payload/evaltest.dat b/testing/tests/ikev2/config-payload/evaltest.dat
index a429e9b32..b46dfddf6 100644
--- a/testing/tests/ikev2/config-payload/evaltest.dat
+++ b/testing/tests/ikev2/config-payload/evaltest.dat
@@ -5,13 +5,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::cat /etc/resolv.conf::nameserver PH_IP_WINNETOU .*from moon.strongswan.org::YES
carol::cat /etc/resolv.conf::nameserver PH_IP_VENUS .*from moon.strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES
diff --git a/testing/tests/ikev2/config-payload/posttest.dat b/testing/tests/ikev2/config-payload/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/config-payload/posttest.dat
+++ b/testing/tests/ikev2/config-payload/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/config-payload/pretest.dat b/testing/tests/ikev2/config-payload/pretest.dat
index 014e80517..3864bdac3 100644
--- a/testing/tests/ikev2/config-payload/pretest.dat
+++ b/testing/tests/ikev2/config-payload/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/config-payload/test.conf b/testing/tests/ikev2/config-payload/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/config-payload/test.conf
+++ b/testing/tests/ikev2/config-payload/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/critical-extension/posttest.dat b/testing/tests/ikev2/critical-extension/posttest.dat
index a4c96e10f..837738fc6 100644
--- a/testing/tests/ikev2/critical-extension/posttest.dat
+++ b/testing/tests/ikev2/critical-extension/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/critical-extension/pretest.dat b/testing/tests/ikev2/critical-extension/pretest.dat
index 2d7a78acb..c724e5df8 100644
--- a/testing/tests/ikev2/critical-extension/pretest.dat
+++ b/testing/tests/ikev2/critical-extension/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/critical-extension/test.conf b/testing/tests/ikev2/critical-extension/test.conf
index 41ee3037e..b286ef6eb 100644
--- a/testing/tests/ikev2/critical-extension/test.conf
+++ b/testing/tests/ikev2/critical-extension/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/crl-from-cache/test.conf b/testing/tests/ikev2/crl-from-cache/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/crl-from-cache/test.conf
+++ b/testing/tests/ikev2/crl-from-cache/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 999d0d183..000000000
--- a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ldap crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules
new file mode 100644
index 000000000..debcc2181
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/iptables.rules
@@ -0,0 +1,28 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow ldap crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 4f4f3228b..000000000
--- a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ldap crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..debcc2181
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/iptables.rules
@@ -0,0 +1,28 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow ldap crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/crl-ldap/posttest.dat b/testing/tests/ikev2/crl-ldap/posttest.dat
index bddd87424..8474bd3aa 100644
--- a/testing/tests/ikev2/crl-ldap/posttest.dat
+++ b/testing/tests/ikev2/crl-ldap/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
winnetou::/etc/init.d/slapd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/crls/*
carol::rm /etc/ipsec.d/crls/*
diff --git a/testing/tests/ikev2/crl-ldap/pretest.dat b/testing/tests/ikev2/crl-ldap/pretest.dat
index 64fa8116b..8ffa9d3ed 100644
--- a/testing/tests/ikev2/crl-ldap/pretest.dat
+++ b/testing/tests/ikev2/crl-ldap/pretest.dat
@@ -1,6 +1,6 @@
winnetou::/etc/init.d/slapd start
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 2
diff --git a/testing/tests/ikev2/crl-ldap/test.conf b/testing/tests/ikev2/crl-ldap/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/crl-ldap/test.conf
+++ b/testing/tests/ikev2/crl-ldap/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/crl-revoked/test.conf b/testing/tests/ikev2/crl-revoked/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/crl-revoked/test.conf
+++ b/testing/tests/ikev2/crl-revoked/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/crl-to-cache/test.conf b/testing/tests/ikev2/crl-to-cache/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/crl-to-cache/test.conf
+++ b/testing/tests/ikev2/crl-to-cache/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/default-keys/description.txt b/testing/tests/ikev2/default-keys/description.txt
index 639e909da..889f8297a 100644
--- a/testing/tests/ikev2/default-keys/description.txt
+++ b/testing/tests/ikev2/default-keys/description.txt
@@ -1,8 +1,8 @@
Because of the missing <b>/etc/ipsec.secrets</b> file, roadwarrior <b>carol</b>
and gateway <b>moon</b> each automatically generate a PKCS#1 RSA private key
-and a self-signed X.509 certificate. Because the UML testing environment does
-not offer enough entropy, the non-blocking /dev/urandom device is used in place
-of /dev/random for generating the random primes.
+and a self-signed X.509 certificate. Because the virtual testing environment
+does not offer enough entropy, the non-blocking /dev/urandom device is used in
+place of /dev/random for generating the random primes.
<p>
The self-signed certificates are then distributed to the peers via scp
and are used to set up a road warrior connection initiated by <b>carol</b>
diff --git a/testing/tests/ikev2/default-keys/evaltest.dat b/testing/tests/ikev2/default-keys/evaltest.dat
index 1c206fff0..4df2d1e11 100644
--- a/testing/tests/ikev2/default-keys/evaltest.dat
+++ b/testing/tests/ikev2/default-keys/evaltest.dat
@@ -4,6 +4,6 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*CN=carol.*CN=moon::YES
moon:: ipsec status 2> /dev/null::carol.*ESTABLISHED.*CN=moon.*CN=carol::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 5a262c084..000000000
--- a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A INPUT -p tcp --sport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..72a1c17c3
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/iptables.rules
@@ -0,0 +1,30 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --sport 22 -j ACCEPT
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+-A OUTPUT -p tcp --dport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/default-keys/posttest.dat b/testing/tests/ikev2/default-keys/posttest.dat
index 8cada5e7e..25f737ecc 100644
--- a/testing/tests/ikev2/default-keys/posttest.dat
+++ b/testing/tests/ikev2/default-keys/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
carol::rm /etc/ipsec.d/private/*
carol::rm /etc/ipsec.d/certs/*
moon::rm /etc/ipsec.d/private/*
diff --git a/testing/tests/ikev2/default-keys/pretest.dat b/testing/tests/ikev2/default-keys/pretest.dat
index 88f9a2ca9..ef5f67097 100644
--- a/testing/tests/ikev2/default-keys/pretest.dat
+++ b/testing/tests/ikev2/default-keys/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
carol::rm /etc/ipsec.secrets
carol::rm /etc/ipsec.d/private/*
carol::rm /etc/ipsec.d/certs/*
@@ -10,9 +10,10 @@ moon::rm /etc/ipsec.d/private/*
moon::rm /etc/ipsec.d/certs/*
moon::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
-moon::sleep 5
+moon::sleep 5
moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der
moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der
-moon::ipsec reload
-carol::ipsec reload
+moon::ipsec reload
+carol::ipsec reload
+carol::sleep 1
carol::ipsec up home
diff --git a/testing/tests/ikev2/default-keys/test.conf b/testing/tests/ikev2/default-keys/test.conf
index 0baa48d90..ce84ce41a 100644
--- a/testing/tests/ikev2/default-keys/test.conf
+++ b/testing/tests/ikev2/default-keys/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol"
+VIRTHOSTS="alice moon carol"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/dhcp-dynamic/evaltest.dat b/testing/tests/ikev2/dhcp-dynamic/evaltest.dat
index 4b0ddace7..9e536870e 100644
--- a/testing/tests/ikev2/dhcp-dynamic/evaltest.dat
+++ b/testing/tests/ikev2/dhcp-dynamic/evaltest.dat
@@ -1,11 +1,11 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.1.0.50::64 bytes from 10.1.0.50: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 10.1.0.50::64 bytes from 10.1.0.50: icmp_req=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.1.0.51::64 bytes from 10.1.0.51: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 10.1.0.51::64 bytes from 10.1.0.51: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.50/32::YES
@@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
-alice::tcpdump::arp reply carol3.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::ARP, Reply carol3.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP carol3.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol3.strongswan.org: ICMP echo reply::YES
-alice::tcpdump::arp reply dave3.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::ARP, Reply dave3.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > dave3.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave3.strongswan.org > alice.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 058bebb2d..000000000
--- a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow bootpc and bootps
- iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
- iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT
-
- # allow broadcasts from eth1
- iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- iptables -A INPUT -j LOG --log-prefix " IN: "
- iptables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..2d9a466b0
--- /dev/null
+++ b/testing/tests/ikev2/dhcp-dynamic/hosts/moon/etc/iptables.rules
@@ -0,0 +1,39 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow bootpc and bootps
+-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
+-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT
+
+# allow broadcasts from eth1
+-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcp/dhcpd.conf
index 2176af702..7a178505f 100644
--- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcpd.conf
+++ b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dhcp/dhcpd.conf
@@ -4,11 +4,11 @@ ddns-update-style none;
subnet 10.1.0.0 netmask 255.255.0.0 {
option domain-name "strongswan.org";
- option domain-name-servers 10.1.0.20;
- option netbios-name-servers 10.1.0.10;
- option routers 10.1.0.1;
+ option domain-name-servers PH_IP_VENUS;
+ option netbios-name-servers PH_IP_ALICE;
+ option routers PH_IP_MOON1;
option broadcast-address 10.1.255.255;
- next-server 10.1.0.20;
+ next-server PH_IP_VENUS;
range 10.1.0.50 10.1.0.60;
}
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf
index 2d35dfd64..ec8c945a7 100644
--- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf
+++ b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/dnsmasq.conf
@@ -1,7 +1,7 @@
interface=eth0
dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255
-dhcp-option=option:router,10.1.0.1
-dhcp-option=option:dns-server,10.1.0.20
-dhcp-option=option:netbios-ns,10.1.0.10
+dhcp-option=option:router,PH_IP_MOON1
+dhcp-option=option:dns-server,PH_IP_VENUS
+dhcp-option=option:netbios-ns,PH_IP_ALICE
dhcp-option=option:domain-name,strongswan.org
log-dhcp
diff --git a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd
deleted file mode 100755
index 4044dcc35..000000000
--- a/testing/tests/ikev2/dhcp-dynamic/hosts/venus/etc/init.d/dhcpd
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop"
-
-depend() {
- need net
- need logger
-}
-
-start() {
- ebegin "Starting DHCP server"
- start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd
- eend $?
-}
-
-stop() {
- ebegin "Stopping DHCP server"
- start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid
- rm -f /var/state/dhcp/dhcpd.leases
- touch /var/state/dhcp/dhcpd.leases
- eend $?
-}
diff --git a/testing/tests/ikev2/dhcp-dynamic/posttest.dat b/testing/tests/ikev2/dhcp-dynamic/posttest.dat
index 1f5487596..f783127bf 100644
--- a/testing/tests/ikev2/dhcp-dynamic/posttest.dat
+++ b/testing/tests/ikev2/dhcp-dynamic/posttest.dat
@@ -2,9 +2,9 @@ moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
venus::cat /var/state/dhcp/dhcpd.leases
-venus::/etc/init.d/dhcpd stop 2> /dev/null
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
alice::arp -d 10.1.0.50
alice::arp -d 10.1.0.51
diff --git a/testing/tests/ikev2/dhcp-dynamic/pretest.dat b/testing/tests/ikev2/dhcp-dynamic/pretest.dat
index bd36b4fe3..5670a2e89 100644
--- a/testing/tests/ikev2/dhcp-dynamic/pretest.dat
+++ b/testing/tests/ikev2/dhcp-dynamic/pretest.dat
@@ -1,12 +1,12 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-venus::cat /etc/dhcpd.conf
-venus::/etc/init.d/dhcpd start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+venus::cat /etc/dhcp/dhcpd.conf
+venus::/etc/init.d/isc-dhcp-server start 2> /dev/null
carol::ipsec start
dave::ipsec start
moon::ipsec start
-carol::sleep 2
+carol::sleep 2
carol::ipsec up home
dave::ipsec up home
carol::sleep 1
diff --git a/testing/tests/ikev2/dhcp-dynamic/test.conf b/testing/tests/ikev2/dhcp-dynamic/test.conf
index a2ad7b25f..fd8a59c90 100644
--- a/testing/tests/ikev2/dhcp-dynamic/test.conf
+++ b/testing/tests/ikev2/dhcp-dynamic/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat b/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat
index 830094c7a..c95b69a11 100644
--- a/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat
+++ b/testing/tests/ikev2/dhcp-static-client-id/evaltest.dat
@@ -1,11 +1,11 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.30/32::YES
@@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
-alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES
-alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 058bebb2d..000000000
--- a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow bootpc and bootps
- iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
- iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT
-
- # allow broadcasts from eth1
- iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- iptables -A INPUT -j LOG --log-prefix " IN: "
- iptables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..2d9a466b0
--- /dev/null
+++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/moon/etc/iptables.rules
@@ -0,0 +1,39 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow bootpc and bootps
+-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
+-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT
+
+# allow broadcasts from eth1
+-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcp/dhcpd.conf
index 44ee681b6..334ea30e2 100644
--- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcpd.conf
+++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dhcp/dhcpd.conf
@@ -4,11 +4,11 @@ ddns-update-style none;
subnet 10.1.0.0 netmask 255.255.0.0 {
option domain-name "strongswan.org";
- option domain-name-servers 10.1.0.20;
- option netbios-name-servers 10.1.0.10;
- option routers 10.1.0.1;
+ option domain-name-servers PH_IP_VENUS;
+ option netbios-name-servers PH_IP_ALICE;
+ option routers PH_IP_MOON1;
option broadcast-address 10.1.255.255;
- next-server 10.1.0.20;
+ next-server PH_IP_VENUS;
range 10.1.0.50 10.1.0.60;
}
@@ -22,4 +22,3 @@ host dave {
option dhcp-client-identifier "dave@strongswan.org";
fixed-address 10.1.0.40;
}
-
diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf
index 5672236a0..aca225955 100644
--- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf
+++ b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/dnsmasq.conf
@@ -2,8 +2,8 @@ interface=eth0
dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255
dhcp-host=id:carol@strongswan.org,10.1.0.30
dhcp-host=id:dave@strongswan.org,10.1.0.40
-dhcp-option=option:router,10.1.0.1
-dhcp-option=option:dns-server,10.1.0.20
-dhcp-option=option:netbios-ns,10.1.0.10
+dhcp-option=option:router,PH_IP_MOON1
+dhcp-option=option:dns-server,PH_IP_VENUS
+dhcp-option=option:netbios-ns,PH_IP_ALICE
dhcp-option=option:domain-name,strongswan.org
log-dhcp
diff --git a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd
deleted file mode 100755
index 4044dcc35..000000000
--- a/testing/tests/ikev2/dhcp-static-client-id/hosts/venus/etc/init.d/dhcpd
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop"
-
-depend() {
- need net
- need logger
-}
-
-start() {
- ebegin "Starting DHCP server"
- start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd
- eend $?
-}
-
-stop() {
- ebegin "Stopping DHCP server"
- start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid
- rm -f /var/state/dhcp/dhcpd.leases
- touch /var/state/dhcp/dhcpd.leases
- eend $?
-}
diff --git a/testing/tests/ikev2/dhcp-static-client-id/posttest.dat b/testing/tests/ikev2/dhcp-static-client-id/posttest.dat
index e1aadc618..7fff9981b 100644
--- a/testing/tests/ikev2/dhcp-static-client-id/posttest.dat
+++ b/testing/tests/ikev2/dhcp-static-client-id/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-venus::/etc/init.d/dhcpd stop 2> /dev/null
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
alice::arp -d 10.1.0.30
alice::arp -d 10.1.0.40
diff --git a/testing/tests/ikev2/dhcp-static-client-id/pretest.dat b/testing/tests/ikev2/dhcp-static-client-id/pretest.dat
index bd36b4fe3..5670a2e89 100644
--- a/testing/tests/ikev2/dhcp-static-client-id/pretest.dat
+++ b/testing/tests/ikev2/dhcp-static-client-id/pretest.dat
@@ -1,12 +1,12 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-venus::cat /etc/dhcpd.conf
-venus::/etc/init.d/dhcpd start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+venus::cat /etc/dhcp/dhcpd.conf
+venus::/etc/init.d/isc-dhcp-server start 2> /dev/null
carol::ipsec start
dave::ipsec start
moon::ipsec start
-carol::sleep 2
+carol::sleep 2
carol::ipsec up home
dave::ipsec up home
carol::sleep 1
diff --git a/testing/tests/ikev2/dhcp-static-client-id/test.conf b/testing/tests/ikev2/dhcp-static-client-id/test.conf
index a2ad7b25f..fd8a59c90 100644
--- a/testing/tests/ikev2/dhcp-static-client-id/test.conf
+++ b/testing/tests/ikev2/dhcp-static-client-id/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/dhcp-static-mac/evaltest.dat b/testing/tests/ikev2/dhcp-static-mac/evaltest.dat
index 830094c7a..c95b69a11 100644
--- a/testing/tests/ikev2/dhcp-static-mac/evaltest.dat
+++ b/testing/tests/ikev2/dhcp-static-mac/evaltest.dat
@@ -1,11 +1,11 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*10.1.0.0/16 === 10.1.0.30/32::YES
@@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
-alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES
-alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 058bebb2d..000000000
--- a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow bootpc and bootps
- iptables -A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
- iptables -A INPUT -p udp --sport bootps --dport bootps -j ACCEPT
-
- # allow broadcasts from eth1
- iptables -A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- iptables -A INPUT -j LOG --log-prefix " IN: "
- iptables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..2d9a466b0
--- /dev/null
+++ b/testing/tests/ikev2/dhcp-static-mac/hosts/moon/etc/iptables.rules
@@ -0,0 +1,39 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow bootpc and bootps
+-A OUTPUT -p udp --sport bootpc --dport bootps -j ACCEPT
+-A INPUT -p udp --sport bootps --dport bootps -j ACCEPT
+
+# allow broadcasts from eth1
+-A INPUT -i eth1 -d 10.1.255.255 -j ACCEPT
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcpd.conf b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcp/dhcpd.conf
index 20666f701..cdade2f2e 100644
--- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcpd.conf
+++ b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dhcp/dhcpd.conf
@@ -4,11 +4,11 @@ ddns-update-style none;
subnet 10.1.0.0 netmask 255.255.0.0 {
option domain-name "strongswan.org";
- option domain-name-servers 10.1.0.20;
- option netbios-name-servers 10.1.0.10;
- option routers 10.1.0.1;
+ option domain-name-servers PH_IP_VENUS;
+ option netbios-name-servers PH_IP_ALICE;
+ option routers PH_IP_MOON1;
option broadcast-address 10.1.255.255;
- next-server 10.1.0.20;
+ next-server PH_IP_VENUS;
range 10.1.0.50 10.1.0.60;
}
@@ -22,4 +22,3 @@ host dave {
hardware ethernet 7a:a7:35:78:bc:85;
fixed-address 10.1.0.40;
}
-
diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf
index e3729081f..61d31a0ba 100644
--- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf
+++ b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/dnsmasq.conf
@@ -2,8 +2,8 @@ interface=eth0
dhcp-range=10.1.0.50,10.1.0.60,255.255.0.0,10.1.255.255
dhcp-host=7a:a7:8f:fc:db:3b,10.1.0.30
dhcp-host=7a:a7:35:78:bc:85,10.1.0.40
-dhcp-option=option:router,10.1.0.1
-dhcp-option=option:dns-server,10.1.0.20
-dhcp-option=option:netbios-ns,10.1.0.10
+dhcp-option=option:router,PH_IP_MOON1
+dhcp-option=option:dns-server,PH_IP_VENUS
+dhcp-option=option:netbios-ns,PH_IP_ALICE
dhcp-option=option:domain-name,strongswan.org
log-dhcp
diff --git a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd b/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd
deleted file mode 100755
index 4044dcc35..000000000
--- a/testing/tests/ikev2/dhcp-static-mac/hosts/venus/etc/init.d/dhcpd
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop"
-
-depend() {
- need net
- need logger
-}
-
-start() {
- ebegin "Starting DHCP server"
- start-stop-daemon --start --quiet --exec /usr/sbin/dhcpd
- eend $?
-}
-
-stop() {
- ebegin "Stopping DHCP server"
- start-stop-daemon --stop --quiet --pidfile /var/run/dhcpd.pid
- rm -f /var/state/dhcp/dhcpd.leases
- touch /var/state/dhcp/dhcpd.leases
- eend $?
-}
diff --git a/testing/tests/ikev2/dhcp-static-mac/posttest.dat b/testing/tests/ikev2/dhcp-static-mac/posttest.dat
index e1aadc618..7fff9981b 100644
--- a/testing/tests/ikev2/dhcp-static-mac/posttest.dat
+++ b/testing/tests/ikev2/dhcp-static-mac/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-venus::/etc/init.d/dhcpd stop 2> /dev/null
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+venus::/etc/init.d/isc-dhcp-server stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
alice::arp -d 10.1.0.30
alice::arp -d 10.1.0.40
diff --git a/testing/tests/ikev2/dhcp-static-mac/pretest.dat b/testing/tests/ikev2/dhcp-static-mac/pretest.dat
index bd36b4fe3..5670a2e89 100644
--- a/testing/tests/ikev2/dhcp-static-mac/pretest.dat
+++ b/testing/tests/ikev2/dhcp-static-mac/pretest.dat
@@ -1,12 +1,12 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-venus::cat /etc/dhcpd.conf
-venus::/etc/init.d/dhcpd start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+venus::cat /etc/dhcp/dhcpd.conf
+venus::/etc/init.d/isc-dhcp-server start 2> /dev/null
carol::ipsec start
dave::ipsec start
moon::ipsec start
-carol::sleep 2
+carol::sleep 2
carol::ipsec up home
dave::ipsec up home
carol::sleep 1
diff --git a/testing/tests/ikev2/dhcp-static-mac/test.conf b/testing/tests/ikev2/dhcp-static-mac/test.conf
index a2ad7b25f..fd8a59c90 100644
--- a/testing/tests/ikev2/dhcp-static-mac/test.conf
+++ b/testing/tests/ikev2/dhcp-static-mac/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/double-nat-net/evaltest.dat b/testing/tests/ikev2/double-nat-net/evaltest.dat
index 05dc82d70..52c561964 100644
--- a/testing/tests/ikev2/double-nat-net/evaltest.dat
+++ b/testing/tests/ikev2/double-nat-net/evaltest.dat
@@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@
bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
-alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
+alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/double-nat-net/posttest.dat b/testing/tests/ikev2/double-nat-net/posttest.dat
index 484297418..63d4f98e7 100644
--- a/testing/tests/ikev2/double-nat-net/posttest.dat
+++ b/testing/tests/ikev2/double-nat-net/posttest.dat
@@ -1,7 +1,7 @@
bob::ipsec stop
alice::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-bob::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+bob::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
sun::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/ikev2/double-nat-net/pretest.dat b/testing/tests/ikev2/double-nat-net/pretest.dat
index 41b69aed6..17a4fe5eb 100644
--- a/testing/tests/ikev2/double-nat-net/pretest.dat
+++ b/testing/tests/ikev2/double-nat-net/pretest.dat
@@ -1,8 +1,5 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-bob::/etc/init.d/iptables start 2> /dev/null
-bob::echo 1 > /proc/sys/net/ipv4/ip_forward
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
-sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+bob::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
diff --git a/testing/tests/ikev2/double-nat-net/test.conf b/testing/tests/ikev2/double-nat-net/test.conf
index 1ca2ffe5a..d2e31d257 100644
--- a/testing/tests/ikev2/double-nat-net/test.conf
+++ b/testing/tests/ikev2/double-nat-net/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice bob"
diff --git a/testing/tests/ikev2/double-nat/evaltest.dat b/testing/tests/ikev2/double-nat/evaltest.dat
index b080482f9..9ddad2de5 100644
--- a/testing/tests/ikev2/double-nat/evaltest.dat
+++ b/testing/tests/ikev2/double-nat/evaltest.dat
@@ -2,6 +2,6 @@ alice::ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*alice@strongswan.org.*bob@
bob:: ipsec status 2> /dev/null::nat-t.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
bob:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules b/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev2/double-nat/hosts/bob/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/double-nat/posttest.dat b/testing/tests/ikev2/double-nat/posttest.dat
index 5d39e406d..aa806bfc9 100644
--- a/testing/tests/ikev2/double-nat/posttest.dat
+++ b/testing/tests/ikev2/double-nat/posttest.dat
@@ -1,7 +1,7 @@
bob::ipsec stop
alice::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-bob::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+bob::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
sun::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/ikev2/double-nat/pretest.dat b/testing/tests/ikev2/double-nat/pretest.dat
index 10ba6d735..65f18b756 100644
--- a/testing/tests/ikev2/double-nat/pretest.dat
+++ b/testing/tests/ikev2/double-nat/pretest.dat
@@ -1,7 +1,5 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-bob::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
-sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+bob::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
diff --git a/testing/tests/ikev2/double-nat/test.conf b/testing/tests/ikev2/double-nat/test.conf
index 1ca2ffe5a..d2e31d257 100644
--- a/testing/tests/ikev2/double-nat/test.conf
+++ b/testing/tests/ikev2/double-nat/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice bob"
diff --git a/testing/tests/ikev2/dpd-clear/test.conf b/testing/tests/ikev2/dpd-clear/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/dpd-clear/test.conf
+++ b/testing/tests/ikev2/dpd-clear/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/dpd-hold/test.conf b/testing/tests/ikev2/dpd-hold/test.conf
index 5442565f8..f8b62b953 100644
--- a/testing/tests/ikev2/dpd-hold/test.conf
+++ b/testing/tests/ikev2/dpd-hold/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/dpd-restart/test.conf b/testing/tests/ikev2/dpd-restart/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/dpd-restart/test.conf
+++ b/testing/tests/ikev2/dpd-restart/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/dynamic-initiator/evaltest.dat b/testing/tests/ikev2/dynamic-initiator/evaltest.dat
index 9d050ecde..3db70be71 100644
--- a/testing/tests/ikev2/dynamic-initiator/evaltest.dat
+++ b/testing/tests/ikev2/dynamic-initiator/evaltest.dat
@@ -5,6 +5,6 @@ dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES
moon:: cat /var/log/auth.log::IKE_SA carol\[1] established.*PH_IP_CAROL::YES
moon:: cat /var/log/daemon.log::destroying duplicate IKE_SA for.*carol@strongswan.org.*received INITIAL_CONTACT::YES
moon:: cat /var/log/auth.log::IKE_SA carol\[2] established.*PH_IP_DAVE::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
diff --git a/testing/tests/ikev2/dynamic-initiator/posttest.dat b/testing/tests/ikev2/dynamic-initiator/posttest.dat
index 4dbf3d4a4..83063a23f 100644
--- a/testing/tests/ikev2/dynamic-initiator/posttest.dat
+++ b/testing/tests/ikev2/dynamic-initiator/posttest.dat
@@ -2,8 +2,8 @@ dave::ipsec stop
carol::ipsec stop
dave::sleep 1
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/ipsec.d/certs/*
dave::rm /etc/ipsec.d/private/*
diff --git a/testing/tests/ikev2/dynamic-initiator/pretest.dat b/testing/tests/ikev2/dynamic-initiator/pretest.dat
index 92681011f..3e1cfce77 100644
--- a/testing/tests/ikev2/dynamic-initiator/pretest.dat
+++ b/testing/tests/ikev2/dynamic-initiator/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/dynamic-initiator/test.conf b/testing/tests/ikev2/dynamic-initiator/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/dynamic-initiator/test.conf
+++ b/testing/tests/ikev2/dynamic-initiator/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/dynamic-two-peers/evaltest.dat b/testing/tests/ikev2/dynamic-two-peers/evaltest.dat
index 1d5ff68ec..82d2e7318 100644
--- a/testing/tests/ikev2/dynamic-two-peers/evaltest.dat
+++ b/testing/tests/ikev2/dynamic-two-peers/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::moon.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::carol.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::dave.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/ikev2/dynamic-two-peers/posttest.dat b/testing/tests/ikev2/dynamic-two-peers/posttest.dat
index e120b87db..7b2609846 100644
--- a/testing/tests/ikev2/dynamic-two-peers/posttest.dat
+++ b/testing/tests/ikev2/dynamic-two-peers/posttest.dat
@@ -3,6 +3,6 @@ dave::ipsec stop
moon::sleep 1
moon::ipsec stop
moon::mv /etc/hosts.ori /etc/hosts
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/dynamic-two-peers/pretest.dat b/testing/tests/ikev2/dynamic-two-peers/pretest.dat
index 6596a2527..4bb2a4686 100644
--- a/testing/tests/ikev2/dynamic-two-peers/pretest.dat
+++ b/testing/tests/ikev2/dynamic-two-peers/pretest.dat
@@ -1,8 +1,8 @@
moon::mv /etc/hosts /etc/hosts.ori
moon::mv /etc/hosts.stale /etc/hosts
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/dynamic-two-peers/test.conf b/testing/tests/ikev2/dynamic-two-peers/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/dynamic-two-peers/test.conf
+++ b/testing/tests/ikev2/dynamic-two-peers/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat
index 74150fb04..d5d3bc0d3 100644
--- a/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat
+++ b/testing/tests/ikev2/esp-alg-aes-gmac/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES
carol::ipsec statusall 2> /dev/null::NULL_AES_GMAC_256::YES
carol::ip xfrm state::aead rfc4543(gcm(aes))::YES
diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat
+++ b/testing/tests/ikev2/esp-alg-aes-gmac/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat b/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat
+++ b/testing/tests/ikev2/esp-alg-aes-gmac/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/esp-alg-aes-gmac/test.conf b/testing/tests/ikev2/esp-alg-aes-gmac/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/esp-alg-aes-gmac/test.conf
+++ b/testing/tests/ikev2/esp-alg-aes-gmac/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat b/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat
index a66edc5fe..366539936 100644
--- a/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat
+++ b/testing/tests/ikev2/esp-alg-md5-128/evaltest.dat
@@ -2,10 +2,10 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::3DES_CBC/HMAC_MD5_128::YES
carol::ipsec statusall 2> /dev/null::3DES_CBC/HMAC_MD5_128::YES
-moon:: ip xfrm state::auth hmac(md5)::YES
-carol::ip xfrm state::auth hmac(md5)::YES
+moon:: ip xfrm state::auth-trunc hmac(md5)::YES
+carol::ip xfrm state::auth-trunc hmac(md5)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 184::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 184::YES
diff --git a/testing/tests/ikev2/esp-alg-md5-128/posttest.dat b/testing/tests/ikev2/esp-alg-md5-128/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/esp-alg-md5-128/posttest.dat
+++ b/testing/tests/ikev2/esp-alg-md5-128/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/esp-alg-md5-128/pretest.dat b/testing/tests/ikev2/esp-alg-md5-128/pretest.dat
index 3c3df0196..886fdf55c 100644
--- a/testing/tests/ikev2/esp-alg-md5-128/pretest.dat
+++ b/testing/tests/ikev2/esp-alg-md5-128/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/esp-alg-md5-128/test.conf b/testing/tests/ikev2/esp-alg-md5-128/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/esp-alg-md5-128/test.conf
+++ b/testing/tests/ikev2/esp-alg-md5-128/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/esp-alg-null/evaltest.dat b/testing/tests/ikev2/esp-alg-null/evaltest.dat
index 937d85ed2..1b9c6c27e 100644
--- a/testing/tests/ikev2/esp-alg-null/evaltest.dat
+++ b/testing/tests/ikev2/esp-alg-null/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES
carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES
moon:: ip xfrm state::enc ecb(cipher_null)::YES
diff --git a/testing/tests/ikev2/esp-alg-null/posttest.dat b/testing/tests/ikev2/esp-alg-null/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/esp-alg-null/posttest.dat
+++ b/testing/tests/ikev2/esp-alg-null/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/esp-alg-null/pretest.dat b/testing/tests/ikev2/esp-alg-null/pretest.dat
index 3c3df0196..886fdf55c 100644
--- a/testing/tests/ikev2/esp-alg-null/pretest.dat
+++ b/testing/tests/ikev2/esp-alg-null/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/esp-alg-null/test.conf b/testing/tests/ikev2/esp-alg-null/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/esp-alg-null/test.conf
+++ b/testing/tests/ikev2/esp-alg-null/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat b/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat
index 52c27cba5..00c353686 100644
--- a/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat
+++ b/testing/tests/ikev2/esp-alg-sha1-160/evaltest.dat
@@ -2,10 +2,10 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA1_160::YES
carol::ipsec statusall 2> /dev/null::AES_CBC_128/HMAC_SHA1_160::YES
-moon:: ip xfrm state::auth hmac(sha1)::YES
-carol::ip xfrm state::auth hmac(sha1)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha1)::YES
+carol::ip xfrm state::auth-trunc hmac(sha1)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 204::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 204::YES
diff --git a/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat b/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat
+++ b/testing/tests/ikev2/esp-alg-sha1-160/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat b/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat
index 3c3df0196..886fdf55c 100644
--- a/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat
+++ b/testing/tests/ikev2/esp-alg-sha1-160/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/esp-alg-sha1-160/test.conf b/testing/tests/ikev2/esp-alg-sha1-160/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/esp-alg-sha1-160/test.conf
+++ b/testing/tests/ikev2/esp-alg-sha1-160/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/farp/evaltest.dat b/testing/tests/ikev2/farp/evaltest.dat
index 21b10d170..891ec20d5 100644
--- a/testing/tests/ikev2/farp/evaltest.dat
+++ b/testing/tests/ikev2/farp/evaltest.dat
@@ -1,11 +1,11 @@
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 10.1.0.30::64 bytes from 10.1.0.30: icmp_req=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 10.1.0.40::64 bytes from 10.1.0.40: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec status 2> /dev/null::rw-carol.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-dave.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-carol.*INSTALLED, TUNNEL::YES
@@ -14,12 +14,12 @@ moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
-alice::tcpdump::arp reply carol2.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::ARP, Reply carol2.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP carol2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP alice.strongswan.org > carol2.strongswan.org: ICMP echo reply::YES
-alice::tcpdump::arp reply dave2.strongswan.org is-at fe:fd:0a:01:00:01::YES
+alice::tcpdump::ARP, Reply dave2.strongswan.org is-at 52:54:00:43:e3:35::YES
alice::tcpdump::IP alice.strongswan.org > dave2.strongswan.org: ICMP echo request::YES
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo reply::YES
alice::tcpdump::IP dave2.strongswan.org > alice.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/ikev2/farp/posttest.dat b/testing/tests/ikev2/farp/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/farp/posttest.dat
+++ b/testing/tests/ikev2/farp/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/farp/pretest.dat b/testing/tests/ikev2/farp/pretest.dat
index 709931e1b..f0254da6c 100644
--- a/testing/tests/ikev2/farp/pretest.dat
+++ b/testing/tests/ikev2/farp/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
alice::arp -d 10.1.0.30
alice::arp -d 10.1.0.40
carol::ipsec start
diff --git a/testing/tests/ikev2/farp/test.conf b/testing/tests/ikev2/farp/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/farp/test.conf
+++ b/testing/tests/ikev2/farp/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/force-udp-encaps/evaltest.dat b/testing/tests/ikev2/force-udp-encaps/evaltest.dat
index d7fe707ab..36af646d2 100644
--- a/testing/tests/ikev2/force-udp-encaps/evaltest.dat
+++ b/testing/tests/ikev2/force-udp-encaps/evaltest.dat
@@ -3,6 +3,6 @@ sun:: ipsec status 2> /dev/null::nat.t.*ESTABLISHED.*sun.strongswan.org.*alice@
alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES
alice::cat /var/log/daemon.log::faking NAT situation to enforce UDP encapsulation::YES
-alice:: ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon::tcpdump::IP alice.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > alice.strongswan.org.*: UDP::YES
+alice:: ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon::tcpdump::IP alice.strongswan.org.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > alice.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 5bb63f5ac..000000000
--- a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev2/force-udp-encaps/hosts/sun/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/force-udp-encaps/posttest.dat b/testing/tests/ikev2/force-udp-encaps/posttest.dat
index 979f2fcd0..03edb42cb 100644
--- a/testing/tests/ikev2/force-udp-encaps/posttest.dat
+++ b/testing/tests/ikev2/force-udp-encaps/posttest.dat
@@ -1,6 +1,6 @@
alice::ipsec stop
sun::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
sun::ip route del 10.1.0.0/16 via PH_IP_MOON
winnetou::ip route del 10.1.0.0/16 via PH_IP_MOON
diff --git a/testing/tests/ikev2/force-udp-encaps/pretest.dat b/testing/tests/ikev2/force-udp-encaps/pretest.dat
index 6f00cd387..7be66867a 100644
--- a/testing/tests/ikev2/force-udp-encaps/pretest.dat
+++ b/testing/tests/ikev2/force-udp-encaps/pretest.dat
@@ -1,8 +1,7 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+alice::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
sun::ip route add 10.1.0.0/16 via PH_IP_MOON
winnetou::ip route add 10.1.0.0/16 via PH_IP_MOON
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
alice::ipsec start
sun::ipsec start
alice::sleep 4
diff --git a/testing/tests/ikev2/force-udp-encaps/test.conf b/testing/tests/ikev2/force-udp-encaps/test.conf
index d84149aaf..42fa97190 100644
--- a/testing/tests/ikev2/force-udp-encaps/test.conf
+++ b/testing/tests/ikev2/force-udp-encaps/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice sun"
diff --git a/testing/tests/ikev2/host2host-cert/evaltest.dat b/testing/tests/ikev2/host2host-cert/evaltest.dat
index 53e5589ca..3305f4558 100644
--- a/testing/tests/ikev2/host2host-cert/evaltest.dat
+++ b/testing/tests/ikev2/host2host-cert/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su
sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
-moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/host2host-cert/posttest.dat b/testing/tests/ikev2/host2host-cert/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev2/host2host-cert/posttest.dat
+++ b/testing/tests/ikev2/host2host-cert/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/host2host-cert/pretest.dat b/testing/tests/ikev2/host2host-cert/pretest.dat
index 1fa70177c..3bce9f6e5 100644
--- a/testing/tests/ikev2/host2host-cert/pretest.dat
+++ b/testing/tests/ikev2/host2host-cert/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/host2host-cert/test.conf b/testing/tests/ikev2/host2host-cert/test.conf
index 305a67316..55d6e9fd6 100644
--- a/testing/tests/ikev2/host2host-cert/test.conf
+++ b/testing/tests/ikev2/host2host-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/host2host-swapped/evaltest.dat b/testing/tests/ikev2/host2host-swapped/evaltest.dat
index 53e5589ca..3305f4558 100644
--- a/testing/tests/ikev2/host2host-swapped/evaltest.dat
+++ b/testing/tests/ikev2/host2host-swapped/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su
sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
-moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/host2host-swapped/posttest.dat b/testing/tests/ikev2/host2host-swapped/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev2/host2host-swapped/posttest.dat
+++ b/testing/tests/ikev2/host2host-swapped/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/host2host-swapped/pretest.dat b/testing/tests/ikev2/host2host-swapped/pretest.dat
index 1fa70177c..3bce9f6e5 100644
--- a/testing/tests/ikev2/host2host-swapped/pretest.dat
+++ b/testing/tests/ikev2/host2host-swapped/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/host2host-swapped/test.conf b/testing/tests/ikev2/host2host-swapped/test.conf
index 305a67316..55d6e9fd6 100644
--- a/testing/tests/ikev2/host2host-swapped/test.conf
+++ b/testing/tests/ikev2/host2host-swapped/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/host2host-transport/evaltest.dat b/testing/tests/ikev2/host2host-transport/evaltest.dat
index 3021b5e04..fc49e57d8 100644
--- a/testing/tests/ikev2/host2host-transport/evaltest.dat
+++ b/testing/tests/ikev2/host2host-transport/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::host-host.*ESTABLISHED.*moon.strongswan.org.*su
sun:: ipsec status 2> /dev/null::host-host.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
-moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/host2host-transport/posttest.dat b/testing/tests/ikev2/host2host-transport/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev2/host2host-transport/posttest.dat
+++ b/testing/tests/ikev2/host2host-transport/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/host2host-transport/pretest.dat b/testing/tests/ikev2/host2host-transport/pretest.dat
index e2d98f2eb..99789b90f 100644
--- a/testing/tests/ikev2/host2host-transport/pretest.dat
+++ b/testing/tests/ikev2/host2host-transport/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 2
diff --git a/testing/tests/ikev2/host2host-transport/test.conf b/testing/tests/ikev2/host2host-transport/test.conf
index cf2e704fd..5a286c84f 100644
--- a/testing/tests/ikev2/host2host-transport/test.conf
+++ b/testing/tests/ikev2/host2host-transport/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/inactivity-timeout/evaltest.dat b/testing/tests/ikev2/inactivity-timeout/evaltest.dat
index dceceaef6..221c59318 100644
--- a/testing/tests/ikev2/inactivity-timeout/evaltest.dat
+++ b/testing/tests/ikev2/inactivity-timeout/evaltest.dat
@@ -1,8 +1,8 @@
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::sleep 15::NO
carol::cat /var/log/daemon.log::deleting CHILD_SA after 10 seconds of inactivity::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED::NO
carol::ipsec status 2> /dev/null::home.*INSTALLED::NO
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::NO
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::NO
diff --git a/testing/tests/ikev2/inactivity-timeout/posttest.dat b/testing/tests/ikev2/inactivity-timeout/posttest.dat
index 94a400606..6ca9c5b35 100644
--- a/testing/tests/ikev2/inactivity-timeout/posttest.dat
+++ b/testing/tests/ikev2/inactivity-timeout/posttest.dat
@@ -1,4 +1,3 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/inactivity-timeout/pretest.dat b/testing/tests/ikev2/inactivity-timeout/pretest.dat
index 3c3df0196..b949aaeaf 100644
--- a/testing/tests/ikev2/inactivity-timeout/pretest.dat
+++ b/testing/tests/ikev2/inactivity-timeout/pretest.dat
@@ -1,7 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
-carol::sleep 1
+carol::sleep 1
carol::ipsec up home
carol::sleep 1
diff --git a/testing/tests/ikev2/inactivity-timeout/test.conf b/testing/tests/ikev2/inactivity-timeout/test.conf
index acb73b06f..11423f723 100644
--- a/testing/tests/ikev2/inactivity-timeout/test.conf
+++ b/testing/tests/ikev2/inactivity-timeout/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ip-pool-db/evaltest.dat b/testing/tests/ikev2/ip-pool-db/evaltest.dat
index 941cb34c0..42e353084 100644
--- a/testing/tests/ikev2/ip-pool-db/evaltest.dat
+++ b/testing/tests/ikev2/ip-pool-db/evaltest.dat
@@ -6,7 +6,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_VENUS::YES
@@ -15,7 +15,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
diff --git a/testing/tests/ikev2/ip-pool-db/posttest.dat b/testing/tests/ikev2/ip-pool-db/posttest.dat
index 5b88b2163..c99f347e3 100644
--- a/testing/tests/ikev2/ip-pool-db/posttest.dat
+++ b/testing/tests/ikev2/ip-pool-db/posttest.dat
@@ -1,9 +1,9 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::ipsec pool --del bigpool 2> /dev/null
moon::ipsec pool --del dns 2> /dev/null
moon::ipsec pool --del nbns 2> /dev/null
diff --git a/testing/tests/ikev2/ip-pool-db/pretest.dat b/testing/tests/ikev2/ip-pool-db/pretest.dat
index 4a2add194..fce551c69 100644
--- a/testing/tests/ikev2/ip-pool-db/pretest.dat
+++ b/testing/tests/ikev2/ip-pool-db/pretest.dat
@@ -4,9 +4,9 @@ moon::ipsec pool --add bigpool --start 10.3.0.1 --end 10.3.3.232 --timeout 0 2>
moon::ipsec pool --addattr dns --server PH_IP_WINNETOU 2> /dev/null
moon::ipsec pool --addattr dns --server PH_IP_VENUS 2> /dev/null
moon::ipsec pool --addattr nbns --server PH_IP_VENUS 2> /dev/null
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/ip-pool-db/test.conf b/testing/tests/ikev2/ip-pool-db/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/ip-pool-db/test.conf
+++ b/testing/tests/ikev2/ip-pool-db/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/ip-pool-wish/evaltest.dat b/testing/tests/ikev2/ip-pool-wish/evaltest.dat
index fd15d5209..44310cd16 100644
--- a/testing/tests/ikev2/ip-pool-wish/evaltest.dat
+++ b/testing/tests/ikev2/ip-pool-wish/evaltest.dat
@@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org.::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP PH_IP_CAROL1::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
diff --git a/testing/tests/ikev2/ip-pool-wish/posttest.dat b/testing/tests/ikev2/ip-pool-wish/posttest.dat
index 1777f439f..b757d8b15 100644
--- a/testing/tests/ikev2/ip-pool-wish/posttest.dat
+++ b/testing/tests/ikev2/ip-pool-wish/posttest.dat
@@ -1,6 +1,6 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/ip-pool-wish/pretest.dat b/testing/tests/ikev2/ip-pool-wish/pretest.dat
index 1f4ff286a..1466fd2f2 100644
--- a/testing/tests/ikev2/ip-pool-wish/pretest.dat
+++ b/testing/tests/ikev2/ip-pool-wish/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/ip-pool-wish/test.conf b/testing/tests/ikev2/ip-pool-wish/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/ip-pool-wish/test.conf
+++ b/testing/tests/ikev2/ip-pool-wish/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/ip-pool/evaltest.dat b/testing/tests/ikev2/ip-pool/evaltest.dat
index db46646a6..8ea7960b5 100644
--- a/testing/tests/ikev2/ip-pool/evaltest.dat
+++ b/testing/tests/ikev2/ip-pool/evaltest.dat
@@ -3,19 +3,19 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::adding virtual IP address pool::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
moon:: ipsec leases 10.3.0.0/28 2> /dev/null::2/14, 2 online::YES
-moon:: ipsec leases 10.3.0.0/28 10.3.0.1 2> /dev/null::carol@strongswan.org::YES
-moon:: ipsec leases 10.3.0.0/28 10.3.0.2 2> /dev/null::dave@strongswan.org::YES
+moon:: ipsec leases 10.3.0.0/28 PH_IP_CAROL1 2> /dev/null::carol@strongswan.org::YES
+moon:: ipsec leases 10.3.0.0/28 PH_IP_DAVE1 2> /dev/null::dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::ESP
diff --git a/testing/tests/ikev2/ip-pool/posttest.dat b/testing/tests/ikev2/ip-pool/posttest.dat
index 1777f439f..b757d8b15 100644
--- a/testing/tests/ikev2/ip-pool/posttest.dat
+++ b/testing/tests/ikev2/ip-pool/posttest.dat
@@ -1,6 +1,6 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/ip-pool/pretest.dat b/testing/tests/ikev2/ip-pool/pretest.dat
index 014e80517..3864bdac3 100644
--- a/testing/tests/ikev2/ip-pool/pretest.dat
+++ b/testing/tests/ikev2/ip-pool/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/ip-pool/test.conf b/testing/tests/ikev2/ip-pool/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/ip-pool/test.conf
+++ b/testing/tests/ikev2/ip-pool/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/ip-split-pools-db/test.conf b/testing/tests/ikev2/ip-split-pools-db/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/ip-split-pools-db/test.conf
+++ b/testing/tests/ikev2/ip-split-pools-db/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/ip-two-pools-db/evaltest.dat b/testing/tests/ikev2/ip-two-pools-db/evaltest.dat
index fd0413d11..fdc3d4d3f 100644
--- a/testing/tests/ikev2/ip-two-pools-db/evaltest.dat
+++ b/testing/tests/ikev2/ip-two-pools-db/evaltest.dat
@@ -28,10 +28,10 @@ carol::cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU to /etc/res
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU to /etc/resolv.conf::YES
alice::cat /var/log/daemon.log::installing DNS server PH_IP_ALICE to /etc/resolv.conf::YES
venus::cat /var/log/daemon.log::installing DNS server PH_IP_VENUS to /etc/resolv.conf::YES
-alice::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES
-alice::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_seq=1::YES
-dave:: ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES
+alice::ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_req=1::YES
+dave:: ping -c 1 10.4.0.2::64 bytes from 10.4.0.2: icmp_req=1::YES
alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES
alice::tcpdump::IP moon1.strongswan.org > alice.strongswan.org: ESP::YES
dave::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index 97b773645..000000000
--- a/testing/tests/ikev2/ip-two-pools-db/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MOBIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index bb9d03acd..000000000
--- a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
- iptables -A INPUT -i eth1 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
- iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # masquerade crl fetches to winnetou
- iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..a0ed9f0e6
--- /dev/null
+++ b/testing/tests/ikev2/ip-two-pools-db/hosts/moon/etc/iptables.rules
@@ -0,0 +1,43 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+-A INPUT -i eth1 -p 50 -j ACCEPT
+-A OUTPUT -o eth1 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+COMMIT
+
+*nat
+
+# masquerade crl fetches to winnetou
+-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE
+
+COMMIT
diff --git a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables
deleted file mode 100755
index 97b773645..000000000
--- a/testing/tests/ikev2/ip-two-pools-db/hosts/venus/etc/init.d/iptables
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MOBIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/ip-two-pools-db/posttest.dat b/testing/tests/ikev2/ip-two-pools-db/posttest.dat
index 7b0393ebd..9c0bb5cae 100644
--- a/testing/tests/ikev2/ip-two-pools-db/posttest.dat
+++ b/testing/tests/ikev2/ip-two-pools-db/posttest.dat
@@ -3,11 +3,11 @@ venus::ipsec stop
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+venus::iptables-restore < /etc/iptables.flush
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::ip route del 10.3.0.0/16 via PH_IP_MOON
moon::ip route del 10.4.0.0/16 via PH_IP_MOON1
moon::conntrack -F
diff --git a/testing/tests/ikev2/ip-two-pools-db/pretest.dat b/testing/tests/ikev2/ip-two-pools-db/pretest.dat
index e4eb8b0b9..3aba87994 100644
--- a/testing/tests/ikev2/ip-two-pools-db/pretest.dat
+++ b/testing/tests/ikev2/ip-two-pools-db/pretest.dat
@@ -8,11 +8,11 @@ moon::ipsec pool --addattr dns --server PH_IP_WINNETOU --pool extpool 2> /dev/nu
moon::ipsec pool --statusattr 2> /dev/null
moon::ip route add 10.3.0.0/16 via PH_IP_MOON
moon::ip route add 10.4.0.0/16 via PH_IP_MOON1
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+alice::iptables-restore < /etc/iptables.rules
+venus::iptables-restore < /etc/iptables.rules
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
alice::ipsec start
venus::ipsec start
carol::ipsec start
diff --git a/testing/tests/ikev2/ip-two-pools-db/test.conf b/testing/tests/ikev2/ip-two-pools-db/test.conf
index ea1307b16..c88e11d28 100644
--- a/testing/tests/ikev2/ip-two-pools-db/test.conf
+++ b/testing/tests/ikev2/ip-two-pools-db/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice venus carol dave"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus moon carol dave"
diff --git a/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat b/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat
index 3b09b32bd..0d7a36452 100644
--- a/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat
+++ b/testing/tests/ikev2/ip-two-pools-mixed/evaltest.dat
@@ -13,8 +13,8 @@ moon:: ipsec pool --status 2> /dev/null::intpool.*10.4.0.1.*10.4.1.244.*static.*
moon:: ipsec pool --leases --filter pool=intpool,addr=10.4.0.1,id=alice@strongswan.org 2> /dev/null::online::YES
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES
-carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES
+alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index 97b773645..000000000
--- a/testing/tests/ikev2/ip-two-pools-mixed/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MOBIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index bb9d03acd..000000000
--- a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
- iptables -A INPUT -i eth1 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
- iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # masquerade crl fetches to winnetou
- iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..a0ed9f0e6
--- /dev/null
+++ b/testing/tests/ikev2/ip-two-pools-mixed/hosts/moon/etc/iptables.rules
@@ -0,0 +1,43 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+-A INPUT -i eth1 -p 50 -j ACCEPT
+-A OUTPUT -o eth1 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+COMMIT
+
+*nat
+
+# masquerade crl fetches to winnetou
+-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE
+
+COMMIT
diff --git a/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat b/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat
index db5e6237f..a3924b2f6 100644
--- a/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat
+++ b/testing/tests/ikev2/ip-two-pools-mixed/posttest.dat
@@ -1,9 +1,9 @@
carol::ipsec stop
alice::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-alice::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+alice::iptables-restore < /etc/iptables.flush
moon::conntrack -F
moon::ipsec pool --del intpool 2> /dev/null
moon::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat b/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat
index b579464f2..b74c1e07a 100644
--- a/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat
+++ b/testing/tests/ikev2/ip-two-pools-mixed/pretest.dat
@@ -1,9 +1,9 @@
moon::cat /etc/ipsec.d/tables.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
moon::ipsec pool --add intpool --start 10.4.0.1 --end 10.4.1.244 --timeout 0 2> /dev/null
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+alice::iptables-restore < /etc/iptables.rules
carol::ipsec start
moon::ipsec start
alice::ipsec start
diff --git a/testing/tests/ikev2/ip-two-pools-mixed/test.conf b/testing/tests/ikev2/ip-two-pools-mixed/test.conf
index 329774c0a..1ed3473ab 100644
--- a/testing/tests/ikev2/ip-two-pools-mixed/test.conf
+++ b/testing/tests/ikev2/ip-two-pools-mixed/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice carol"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice moon carol"
diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat
index 7a0c1ed6f..0bf3500b5 100644
--- a/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat
+++ b/testing/tests/ikev2/ip-two-pools-v4v6/evaltest.dat
@@ -5,5 +5,5 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
carol::cat /var/log/daemon.log::installing new virtual IP fec3:\:1::YES
carol::cat /var/log/daemon.log::TS 10.3.0.1/32 fec3:\:1/128 === 10.1.0.0/16 fec1:\:/16::YES
-carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES
carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES
diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat
index fafe030c1..bb20cae05 100644
--- a/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat
+++ b/testing/tests/ikev2/ip-two-pools-v4v6/posttest.dat
@@ -1,5 +1,4 @@
alice::ip -6 route del default via fec1:\:1
carol::ipsec stop
-moon::echo 0 > /proc/sys/net/ipv6/conf/all/forwarding
moon::ipsec stop
moon::conntrack -F
diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat b/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat
index f97ff54b5..04139badf 100644
--- a/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat
+++ b/testing/tests/ikev2/ip-two-pools-v4v6/pretest.dat
@@ -1,5 +1,4 @@
alice::ip -6 route add default via fec1:\:1
-moon::echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
moon::ipsec start
carol::ipsec start
carol::sleep 2
diff --git a/testing/tests/ikev2/ip-two-pools-v4v6/test.conf b/testing/tests/ikev2/ip-two-pools-v4v6/test.conf
index c86dd1d66..cd03759f0 100644
--- a/testing/tests/ikev2/ip-two-pools-v4v6/test.conf
+++ b/testing/tests/ikev2/ip-two-pools-v4v6/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="carol"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ip-two-pools/evaltest.dat b/testing/tests/ikev2/ip-two-pools/evaltest.dat
index 5de62e447..fad3781d7 100644
--- a/testing/tests/ikev2/ip-two-pools/evaltest.dat
+++ b/testing/tests/ikev2/ip-two-pools/evaltest.dat
@@ -10,12 +10,12 @@ moon:: cat /var/log/daemon.log::adding virtual IP address pool.*10.4.0.0/28::YES
moon:: cat /var/log/daemon.log::adding virtual IP address pool.*10.3.0.0/28::YES
moon:: ipsec leases 10.3.0.0/28 2> /dev/null::1/14, 1 online::YES
moon:: ipsec leases 10.4.0.0/28 2> /dev/null::1/14, 1 online::YES
-moon:: ipsec leases 10.3.0.0/28 10.3.0.1 2> /dev/null::carol@strongswan.org::YES
+moon:: ipsec leases 10.3.0.0/28 PH_IP_CAROL1 2> /dev/null::carol@strongswan.org::YES
moon:: ipsec leases 10.4.0.0/28 10.4.0.1 2> /dev/null::alice@strongswan.org::YES
-carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
+carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES
alice::cat /var/log/daemon.log::installing new virtual IP 10.4.0.1::YES
-carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_req=1::YES
+alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
carol::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
carol::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
alice::tcpdump::IP alice.strongswan.org > moon1.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index 97b773645..000000000
--- a/testing/tests/ikev2/ip-two-pools/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MOBIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index bb9d03acd..000000000
--- a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
- iptables -A INPUT -i eth1 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
- iptables -A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # masquerade crl fetches to winnetou
- iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..a0ed9f0e6
--- /dev/null
+++ b/testing/tests/ikev2/ip-two-pools/hosts/moon/etc/iptables.rules
@@ -0,0 +1,43 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+-A INPUT -i eth1 -p 50 -j ACCEPT
+-A OUTPUT -o eth1 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+-A FORWARD -i eth0 -o eth1 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A FORWARD -o eth0 -i eth1 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+COMMIT
+
+*nat
+
+# masquerade crl fetches to winnetou
+-A POSTROUTING -o eth0 -s 10.1.0.0/16 -d PH_IP_WINNETOU -j MASQUERADE
+
+COMMIT
diff --git a/testing/tests/ikev2/ip-two-pools/posttest.dat b/testing/tests/ikev2/ip-two-pools/posttest.dat
index f41bb0fbc..2fbc2c3a0 100644
--- a/testing/tests/ikev2/ip-two-pools/posttest.dat
+++ b/testing/tests/ikev2/ip-two-pools/posttest.dat
@@ -1,8 +1,8 @@
alice::ipsec stop
carol::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-alice::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+alice::iptables-restore < /etc/iptables.flush
moon::conntrack -F
moon::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/ikev2/ip-two-pools/pretest.dat b/testing/tests/ikev2/ip-two-pools/pretest.dat
index db422a105..4e8b639f4 100644
--- a/testing/tests/ikev2/ip-two-pools/pretest.dat
+++ b/testing/tests/ikev2/ip-two-pools/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+alice::iptables-restore < /etc/iptables.rules
carol::ipsec start
moon::ipsec start
alice::ipsec start
diff --git a/testing/tests/ikev2/ip-two-pools/test.conf b/testing/tests/ikev2/ip-two-pools/test.conf
index 329774c0a..1ed3473ab 100644
--- a/testing/tests/ikev2/ip-two-pools/test.conf
+++ b/testing/tests/ikev2/ip-two-pools/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice carol"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice moon carol"
diff --git a/testing/tests/ikev2/mobike-nat/evaltest.dat b/testing/tests/ikev2/mobike-nat/evaltest.dat
index aded7a040..c71e3f7c1 100644
--- a/testing/tests/ikev2/mobike-nat/evaltest.dat
+++ b/testing/tests/ikev2/mobike-nat/evaltest.dat
@@ -2,14 +2,14 @@ alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN::
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-alice::/etc/init.d/net.eth1 stop::No output expected::NO
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_MOON::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::moon.strongswan.org.*sun.strongswan.org.*: UDP-encap: ESP.*seq=0x2::YES
diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index cf0d65c58..000000000
--- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IPsec tunnel traffic
- iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
- iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A INPUT -i eth1 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf
index efbce1fb2..ffb7f563a 100644
--- a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/ipsec.conf
@@ -10,7 +10,7 @@ conn %default
keyexchange=ikev2
conn mobike
- left=PH_IP_ALICE1
+ left=192.168.0.50
leftsourceip=%config
leftcert=aliceCert.pem
leftid=alice@strongswan.org
diff --git a/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules
new file mode 100644
index 000000000..6dd261f20
--- /dev/null
+++ b/testing/tests/ikev2/mobike-nat/hosts/alice/etc/iptables.rules
@@ -0,0 +1,38 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IPsec tunnel traffic
+-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
+-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+# allow ESP
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A INPUT -i eth1 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth1 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 642c414d5..000000000
--- a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IPsec tunnel traffic
- iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
- iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..0a7d1fa40
--- /dev/null
+++ b/testing/tests/ikev2/mobike-nat/hosts/sun/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IPsec tunnel traffic
+-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
+-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+# allow ESP
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/mobike-nat/posttest.dat b/testing/tests/ikev2/mobike-nat/posttest.dat
index cd0d4df25..f4e5316c9 100644
--- a/testing/tests/ikev2/mobike-nat/posttest.dat
+++ b/testing/tests/ikev2/mobike-nat/posttest.dat
@@ -1,6 +1,6 @@
alice::ipsec stop
sun::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/ikev2/mobike-nat/pretest.dat b/testing/tests/ikev2/mobike-nat/pretest.dat
index 08c2be95c..86ac6e7e0 100644
--- a/testing/tests/ikev2/mobike-nat/pretest.dat
+++ b/testing/tests/ikev2/mobike-nat/pretest.dat
@@ -1,12 +1,11 @@
-alice::/etc/init.d/net.eth1 start
-alice::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+alice::ifup eth1
+alice::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::conntrack -F
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
alice::ipsec start
sun::ipsec start
-alice::sleep 2
+alice::sleep 2
alice::ipsec up mobike
alice::sleep 1
diff --git a/testing/tests/ikev2/mobike-nat/test.conf b/testing/tests/ikev2/mobike-nat/test.conf
index 24a0cf3a4..70c64c503 100644
--- a/testing/tests/ikev2/mobike-nat/test.conf
+++ b/testing/tests/ikev2/mobike-nat/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="bob moon sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice sun"
diff --git a/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat b/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat
index c4c7b0b6f..17593ef82 100644
--- a/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat
+++ b/testing/tests/ikev2/mobike-virtual-ip/evaltest.dat
@@ -1,15 +1,15 @@
-alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN::YES
-sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES
+alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES
+sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-alice::/etc/init.d/net.eth1 stop::No output expected::NO
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE::YES
alice::ipsec statusall 2> /dev/null::10.3.0.3/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 10.3.0.3/32::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::alice.strongswan.org.*sun.strongswan.org.*: ESP.*seq=0x2::YES
diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index cf0d65c58..000000000
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IPsec tunnel traffic
- iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
- iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A INPUT -i eth1 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf
index efbce1fb2..ffb7f563a 100644
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/ipsec.conf
@@ -10,7 +10,7 @@ conn %default
keyexchange=ikev2
conn mobike
- left=PH_IP_ALICE1
+ left=192.168.0.50
leftsourceip=%config
leftcert=aliceCert.pem
leftid=alice@strongswan.org
diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules
new file mode 100644
index 000000000..a238c8d19
--- /dev/null
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/alice/etc/iptables.rules
@@ -0,0 +1,38 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IPsec tunnel traffic
+-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
+-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+# allow ESP
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A INPUT -i eth1 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth1 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 642c414d5..000000000
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IPsec tunnel traffic
- iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
- iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf
index eeee6ffb0..2b0c8aebd 100644
--- a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/ipsec.conf
@@ -14,7 +14,7 @@ conn mobike
leftcert=sunCert.pem
leftid=@sun.strongswan.org
leftsubnet=10.2.0.0/16
- right=PH_IP_ALICE1
+ right=192.168.0.50
rightsourceip=10.3.0.3
rightid=alice@strongswan.org
auto=add
diff --git a/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..d86a461ac
--- /dev/null
+++ b/testing/tests/ikev2/mobike-virtual-ip/hosts/sun/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IPsec tunnel traffic
+-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
+-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+# allow ESP
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/mobike-virtual-ip/posttest.dat b/testing/tests/ikev2/mobike-virtual-ip/posttest.dat
index 32fdf0053..95c963091 100644
--- a/testing/tests/ikev2/mobike-virtual-ip/posttest.dat
+++ b/testing/tests/ikev2/mobike-virtual-ip/posttest.dat
@@ -1,5 +1,5 @@
alice::ipsec stop
sun::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
sun::ip route del 10.1.0.0/16 via PH_IP_MOON
diff --git a/testing/tests/ikev2/mobike-virtual-ip/pretest.dat b/testing/tests/ikev2/mobike-virtual-ip/pretest.dat
index 6666e7794..067c1a1ec 100644
--- a/testing/tests/ikev2/mobike-virtual-ip/pretest.dat
+++ b/testing/tests/ikev2/mobike-virtual-ip/pretest.dat
@@ -1,10 +1,9 @@
-alice::/etc/init.d/net.eth1 start
-alice::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::ifup eth1
+alice::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
sun::ip route add 10.1.0.0/16 via PH_IP_MOON
alice::ipsec start
sun::ipsec start
-alice::sleep 2
+alice::sleep 2
alice::ipsec up mobike
alice::sleep 1
diff --git a/testing/tests/ikev2/mobike-virtual-ip/test.conf b/testing/tests/ikev2/mobike-virtual-ip/test.conf
index 24a0cf3a4..70c64c503 100644
--- a/testing/tests/ikev2/mobike-virtual-ip/test.conf
+++ b/testing/tests/ikev2/mobike-virtual-ip/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="bob moon sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice sun"
diff --git a/testing/tests/ikev2/mobike/evaltest.dat b/testing/tests/ikev2/mobike/evaltest.dat
index ebf5ad4cf..e3464040e 100644
--- a/testing/tests/ikev2/mobike/evaltest.dat
+++ b/testing/tests/ikev2/mobike/evaltest.dat
@@ -1,15 +1,15 @@
-alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE1.*PH_IP_SUN::YES
-sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE1::YES
-alice::ipsec statusall 2> /dev/null::PH_IP_ALICE1/32 === 10.2.0.0/16::YES
-sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === PH_IP_ALICE1/32::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-alice::/etc/init.d/net.eth1 stop::No output expected::NO
+alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*192.168.0.50.*PH_IP_SUN::YES
+sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*192.168.0.50::YES
+alice::ipsec statusall 2> /dev/null::192.168.0.50/32 === 10.2.0.0/16::YES
+sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === 192.168.0.50/32::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+alice::ifdown eth1::No output expected::NO
alice::sleep 1::No output expected::NO
alice::ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_ALICE.*PH_IP_SUN::YES
sun:: ipsec status 2> /dev/null::mobike.*ESTABLISHED.*PH_IP_SUN.*PH_IP_ALICE::YES
alice::ipsec statusall 2> /dev/null::PH_IP_ALICE/32 === 10.2.0.0/16::YES
sun:: ipsec statusall 2> /dev/null::10.2.0.0/16 === PH_IP_ALICE/32::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1::YES
sun::tcpdump::sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1::YES
moon::tcpdump::alice.strongswan.org.*sun.strongswan.org: ESP.*seq=0x2::YES
diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index cf0d65c58..000000000
--- a/testing/tests/ikev2/mobike/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IPsec tunnel traffic
- iptables -A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
- iptables -A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A INPUT -i eth1 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf
index 66cbce781..95683fdc3 100644
--- a/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike/hosts/alice/etc/ipsec.conf
@@ -10,7 +10,7 @@ conn %default
keyexchange=ikev2
conn mobike
- left=PH_IP_ALICE1
+ left=192.168.0.50
leftcert=aliceCert.pem
leftid=alice@strongswan.org
right=PH_IP_SUN
diff --git a/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules b/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules
new file mode 100644
index 000000000..a238c8d19
--- /dev/null
+++ b/testing/tests/ikev2/mobike/hosts/alice/etc/iptables.rules
@@ -0,0 +1,38 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IPsec tunnel traffic
+-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
+-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+# allow ESP
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A INPUT -i eth1 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth1 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables b/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 6934b1948..000000000
--- a/testing/tests/ikev2/mobike/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,90 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IPsec tunnel traffic
- iptables -A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
- iptables -A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A INPUT -i eth1 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf
index f3fa9209c..f7693106f 100644
--- a/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev2/mobike/hosts/sun/etc/ipsec.conf
@@ -14,6 +14,6 @@ conn mobike
leftcert=sunCert.pem
leftid=@sun.strongswan.org
leftsubnet=10.2.0.0/16
- right=PH_IP_ALICE1
+ right=192.168.0.50
rightid=alice@strongswan.org
auto=add
diff --git a/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..d86a461ac
--- /dev/null
+++ b/testing/tests/ikev2/mobike/hosts/sun/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IPsec tunnel traffic
+-A FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
+-A FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
+
+# allow ESP
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/mobike/posttest.dat b/testing/tests/ikev2/mobike/posttest.dat
index 32fdf0053..95c963091 100644
--- a/testing/tests/ikev2/mobike/posttest.dat
+++ b/testing/tests/ikev2/mobike/posttest.dat
@@ -1,5 +1,5 @@
alice::ipsec stop
sun::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
sun::ip route del 10.1.0.0/16 via PH_IP_MOON
diff --git a/testing/tests/ikev2/mobike/pretest.dat b/testing/tests/ikev2/mobike/pretest.dat
index 6666e7794..067c1a1ec 100644
--- a/testing/tests/ikev2/mobike/pretest.dat
+++ b/testing/tests/ikev2/mobike/pretest.dat
@@ -1,10 +1,9 @@
-alice::/etc/init.d/net.eth1 start
-alice::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::ifup eth1
+alice::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
sun::ip route add 10.1.0.0/16 via PH_IP_MOON
alice::ipsec start
sun::ipsec start
-alice::sleep 2
+alice::sleep 2
alice::ipsec up mobike
alice::sleep 1
diff --git a/testing/tests/ikev2/mobike/test.conf b/testing/tests/ikev2/mobike/test.conf
index 24a0cf3a4..70c64c503 100644
--- a/testing/tests/ikev2/mobike/test.conf
+++ b/testing/tests/ikev2/mobike/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="bob moon sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice sun"
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat
index 4a72b4392..65a003d23 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/evaltest.dat
@@ -6,7 +6,7 @@ moon:: cat /var/log/daemon.log::received EAP identity .*228060123456001::YES
moon:: cat /var/log/daemon.log::authentication of .*228060123456001@strongswan.org.* with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-mult.*ESTABLISHED.*228060123456001@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*228060123456001@strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::cat /var/log/daemon.log::authentication of .*dave@strongswan.org.* with RSA signature successful::YES
@@ -18,4 +18,4 @@ moon::cat /var/log/daemon.log::EAP method EAP_SIM failed for peer 22806012345600
moon::ipsec status 2> /dev/null::rw-mult.*ESTABLISHED.*228060123456002@strongswan.org::NO
dave::cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
dave::ipsec status 2> /dev/null::home.*ESTABLISHED::NO
-dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf
new file mode 100644
index 000000000..7d8023951
--- /dev/null
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/eap.conf
@@ -0,0 +1,5 @@
+eap {
+ default_eap_type = sim
+ sim {
+ }
+}
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files
new file mode 100644
index 000000000..10c26aa15
--- /dev/null
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/modules/sim_files
@@ -0,0 +1,3 @@
+sim_files {
+ simtriplets = "/etc/freeradius/triplets.dat"
+}
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/sites-available/default
index dfceb037d..91425f812 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/sites-available/default
@@ -59,4 +59,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/triplets.dat
index 002ee94d1..aaabab89e 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/triplets.dat
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/triplets.dat
@@ -4,4 +4,3 @@
228060123456002,33000000000000000000000000000000,33112233,335566778899AABB
228060123456002,34000000000000000000000000000000,34112233,345566778899AABB
228060123456002,35000000000000000000000000000000,35112233,355566778899AABB
-
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/users b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/users
index e69de29bb..e69de29bb 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf
deleted file mode 100644
index a2020424e..000000000
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/eap.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-eap {
- default_eap_type = sim
- sim {
- }
-}
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index d77b818fe..000000000
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,123 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
- sim_files {
- simtriplets = "/etc/raddb/triplets.dat"
- }
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat
index dbe56013a..6a4da6631 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/posttest.dat
@@ -1,7 +1,4 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat
index b3fd4cbf1..2d54c6027 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/pretest.dat
@@ -1,11 +1,8 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-alice::cat /etc/raddb/clients.conf
-alice::cat /etc/raddb/eap.conf
-alice::cat /etc/raddb/proxy.conf
-alice::cat /etc/raddb/triplets.dat
-alice::/etc/init.d/radiusd start
+alice::cat /etc/freeradius/clients.conf
+alice::cat /etc/freeradius/eap.conf
+alice::cat /etc/freeradius/proxy.conf
+alice::cat /etc/freeradius/triplets.dat
+alice::radiusd
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf
index 70416826e..42d23a50b 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/test.conf
@@ -1,21 +1,25 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
+
+# Guest instances on which FreeRadius is started
+#
+RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat b/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat
index c8e7adcb7..2eebc0f84 100644
--- a/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat
+++ b/testing/tests/ikev2/multi-level-ca-cr-init/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/multi-level-ca-cr-init/test.conf b/testing/tests/ikev2/multi-level-ca-cr-init/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev2/multi-level-ca-cr-init/test.conf
+++ b/testing/tests/ikev2/multi-level-ca-cr-init/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat b/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat
index f15265e32..86dd31e83 100644
--- a/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat
+++ b/testing/tests/ikev2/multi-level-ca-cr-resp/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf b/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf
+++ b/testing/tests/ikev2/multi-level-ca-cr-resp/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 4f4f3228b..000000000
--- a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ldap crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..debcc2181
--- /dev/null
+++ b/testing/tests/ikev2/multi-level-ca-ldap/hosts/moon/etc/iptables.rules
@@ -0,0 +1,28 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow ldap crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat b/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat
index ec4ba6e10..6f0ec4b97 100644
--- a/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat
+++ b/testing/tests/ikev2/multi-level-ca-ldap/posttest.dat
@@ -3,5 +3,5 @@ carol::ipsec stop
dave::ipsec stop
moon::rm /etc/ipsec.d/cacerts/*
winnetou::/etc/init.d/slapd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat b/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat
index 322f42102..41319ae4d 100644
--- a/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat
+++ b/testing/tests/ikev2/multi-level-ca-ldap/pretest.dat
@@ -1,5 +1,5 @@
winnetou::/etc/init.d/slapd start
-moon::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/multi-level-ca-ldap/test.conf b/testing/tests/ikev2/multi-level-ca-ldap/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev2/multi-level-ca-ldap/test.conf
+++ b/testing/tests/ikev2/multi-level-ca-ldap/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/multi-level-ca-loop/pretest.dat b/testing/tests/ikev2/multi-level-ca-loop/pretest.dat
index 0a0ec22bf..bb538c160 100644
--- a/testing/tests/ikev2/multi-level-ca-loop/pretest.dat
+++ b/testing/tests/ikev2/multi-level-ca-loop/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
moon::rm /etc/ipsec.d/cacerts/strongswanCert.pem
carol::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/multi-level-ca-loop/test.conf b/testing/tests/ikev2/multi-level-ca-loop/test.conf
index 3189fdfc7..a24ec4f1d 100644
--- a/testing/tests/ikev2/multi-level-ca-loop/test.conf
+++ b/testing/tests/ikev2/multi-level-ca-loop/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat b/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat
index 9f0232a7b..e209e60ff 100644
--- a/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat
+++ b/testing/tests/ikev2/multi-level-ca-pathlen/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
moon::ipsec start
carol::sleep 2
diff --git a/testing/tests/ikev2/multi-level-ca-pathlen/test.conf b/testing/tests/ikev2/multi-level-ca-pathlen/test.conf
index b118cb7dc..587964390 100644
--- a/testing/tests/ikev2/multi-level-ca-pathlen/test.conf
+++ b/testing/tests/ikev2/multi-level-ca-pathlen/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou"
+VIRTHOSTS="alice venus moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/multi-level-ca-revoked/test.conf b/testing/tests/ikev2/multi-level-ca-revoked/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/multi-level-ca-revoked/test.conf
+++ b/testing/tests/ikev2/multi-level-ca-revoked/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/multi-level-ca-strict/pretest.dat b/testing/tests/ikev2/multi-level-ca-strict/pretest.dat
index 67c50c2ef..755564cbc 100644
--- a/testing/tests/ikev2/multi-level-ca-strict/pretest.dat
+++ b/testing/tests/ikev2/multi-level-ca-strict/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/multi-level-ca-strict/test.conf b/testing/tests/ikev2/multi-level-ca-strict/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev2/multi-level-ca-strict/test.conf
+++ b/testing/tests/ikev2/multi-level-ca-strict/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/multi-level-ca/pretest.dat b/testing/tests/ikev2/multi-level-ca/pretest.dat
index 67c50c2ef..755564cbc 100644
--- a/testing/tests/ikev2/multi-level-ca/pretest.dat
+++ b/testing/tests/ikev2/multi-level-ca/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/multi-level-ca/test.conf b/testing/tests/ikev2/multi-level-ca/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev2/multi-level-ca/test.conf
+++ b/testing/tests/ikev2/multi-level-ca/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/nat-rw-mark/description.txt b/testing/tests/ikev2/nat-rw-mark/description.txt
index 2a93d11d8..b8074e665 100644
--- a/testing/tests/ikev2/nat-rw-mark/description.txt
+++ b/testing/tests/ikev2/nat-rw-mark/description.txt
@@ -1,7 +1,7 @@
The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up
tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
Since both roadwarriors possess the same 10.1.0.0/25 subnet, gateway <b>sun</b> uses Source NAT
-after ESP decryption to map these subnets to 10.3.0.10 and 10.3.0.20, respectively.
+after ESP decryption to map these subnets to PH_IP_CAROL10 and PH_IP_DAVE10, respectively.
<p/>
In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively,
<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using
diff --git a/testing/tests/ikev2/nat-rw-mark/evaltest.dat b/testing/tests/ikev2/nat-rw-mark/evaltest.dat
index db9e969d2..bb8e856cc 100644
--- a/testing/tests/ikev2/nat-rw-mark/evaltest.dat
+++ b/testing/tests/ikev2/nat-rw-mark/evaltest.dat
@@ -6,13 +6,13 @@ sun:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*sun.strongswan.org.*alice@
sun:: ipsec status 2> /dev/null::venus.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES
sun:: ipsec statusall 2> /dev/null::alice.*10.2.0.0/16 === 10.1.0.0/25::YES
sun:: ipsec statusall 2> /dev/null::venus.*10.2.0.0/16 === 10.1.0.0/25::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.4510.*: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.4520.*: UDP::YES
-bob::tcpdump::10.3.0.10 > bob.strongswan.org: ICMP echo request::YES
-bob::tcpdump::10.3.0.20 > bob.strongswan.org: ICMP echo request::YES
-bob::tcpdump::bob.strongswan.org > 10.3.0.10: ICMP echo reply::YES
-bob::tcpdump::bob.strongswan.org > 10.3.0.20: ICMP echo reply::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.4510.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP moon.strongswan.org.4520.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.4510.*: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.4520.*: UDP::YES
+bob::tcpdump::PH_IP_CAROL10 > bob.strongswan.org: ICMP echo request::YES
+bob::tcpdump::PH_IP_DAVE10 > bob.strongswan.org: ICMP echo request::YES
+bob::tcpdump::bob.strongswan.org > PH_IP_CAROL10: ICMP echo reply::YES
+bob::tcpdump::bob.strongswan.org > PH_IP_DAVE10: ICMP echo reply::YES
diff --git a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown
index 0d22e684d..421335ffb 100755
--- a/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown
+++ b/testing/tests/ikev2/nat-rw-mark/hosts/sun/etc/mark_updown
@@ -73,8 +73,12 @@
# just the host, this will be 255.255.255.255.
#
# PLUTO_MY_SOURCEIP
-# if non-empty, then the source address for the route will be
-# set to this IP address.
+# PLUTO_MY_SOURCEIP4_$i
+# PLUTO_MY_SOURCEIP6_$i
+# contains IPv4/IPv6 virtual IP received from a responder,
+# $i enumerates from 1 to the number of IP per address family.
+# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first
+# virtual IP, IPv4 or IPv6.
#
# PLUTO_MY_PROTOCOL
# is the IP protocol that will be transported.
@@ -128,9 +132,15 @@
# contains the remote UDP port in the case of ESP_IN_UDP
# encapsulation
#
+# PLUTO_DNS4_$i
+# PLUTO_DNS6_$i
+# contains IPv4/IPv6 DNS server attribute received from a
+# responder, $i enumerates from 1 to the number of servers per
+# address family.
+#
# define a minimum PATH environment in case it is not set
-PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin"
+PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin"
export PATH
# uncomment to log VPN connections
diff --git a/testing/tests/ikev2/nat-rw-mark/posttest.dat b/testing/tests/ikev2/nat-rw-mark/posttest.dat
index 89d5f534b..72dff4e10 100644
--- a/testing/tests/ikev2/nat-rw-mark/posttest.dat
+++ b/testing/tests/ikev2/nat-rw-mark/posttest.dat
@@ -2,10 +2,11 @@ sun::iptables -t mangle -v -n -L PREROUTING
sun::ipsec stop
alice::ipsec stop
venus::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
-moon::iptables -t nat -F
+alice::iptables-restore < /etc/iptables.flush
+venus::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::iptables-restore < /etc/iptables.flush
moon::conntrack -F
+sun::iptables-restore < /etc/iptables.flush
sun::conntrack -F
sun::rm /etc/mark_updown
diff --git a/testing/tests/ikev2/nat-rw-mark/pretest.dat b/testing/tests/ikev2/nat-rw-mark/pretest.dat
index 3ed13d5fa..6cddfd4fe 100644
--- a/testing/tests/ikev2/nat-rw-mark/pretest.dat
+++ b/testing/tests/ikev2/nat-rw-mark/pretest.dat
@@ -1,21 +1,20 @@
-sun::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+sun::iptables-restore < /etc/iptables.rules
+alice::iptables-restore < /etc/iptables.rules
+venus::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to PH_IP_MOON
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 500 -j SNAT --to PH_IP_MOON:510
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 500 -j SNAT --to PH_IP_MOON:520
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_ALICE -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4510
moon::iptables -t nat -A POSTROUTING -o eth0 -s PH_IP_VENUS -p udp --sport 4500 -j SNAT --to PH_IP_MOON:4520
-sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to 10.3.0.10
-sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to 10.3.0.20
-sun::iptables -t mangle -A PREROUTING -d 10.3.0.10 -j MARK --set-mark 10
-sun::iptables -t mangle -A PREROUTING -d 10.3.0.20 -j MARK --set-mark 20
+sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to PH_IP_CAROL10
+sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to PH_IP_DAVE10
+sun::iptables -t mangle -A PREROUTING -d PH_IP_CAROL10 -j MARK --set-mark 10
+sun::iptables -t mangle -A PREROUTING -d PH_IP_DAVE10 -j MARK --set-mark 20
sun::ipsec start
alice::ipsec start
venus::ipsec start
-alice::sleep 2
+alice::sleep 2
alice::ipsec up nat-t
-venus::sleep 2
+venus::sleep 2
venus::ipsec up nat-t
venus::sleep 2
diff --git a/testing/tests/ikev2/nat-rw-mark/test.conf b/testing/tests/ikev2/nat-rw-mark/test.conf
index ae3c190b8..105472cbe 100644
--- a/testing/tests/ikev2/nat-rw-mark/test.conf
+++ b/testing/tests/ikev2/nat-rw-mark/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon bob"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/ikev2/nat-rw-psk/evaltest.dat b/testing/tests/ikev2/nat-rw-psk/evaltest.dat
index 051db978a..6ec29c779 100644
--- a/testing/tests/ikev2/nat-rw-psk/evaltest.dat
+++ b/testing/tests/ikev2/nat-rw-psk/evaltest.dat
@@ -3,7 +3,7 @@ venus::ipsec status 2> /dev/null::nat-t.*INSTALLED. TUNNEL, ESP in UDP::YES
sun:: ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
sun:: ipsec status 2> /dev/null::nat-t.*\[PH_IP_ALICE\]::YES
sun:: ipsec status 2> /dev/null::nat-t.*\[PH_IP_VENUS\]::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-psk/hosts/sun/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/nat-rw-psk/posttest.dat b/testing/tests/ikev2/nat-rw-psk/posttest.dat
index 52572ece8..4643a3a7b 100644
--- a/testing/tests/ikev2/nat-rw-psk/posttest.dat
+++ b/testing/tests/ikev2/nat-rw-psk/posttest.dat
@@ -1,8 +1,8 @@
sun::ipsec stop
alice::ipsec stop
venus::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+venus::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/ikev2/nat-rw-psk/pretest.dat b/testing/tests/ikev2/nat-rw-psk/pretest.dat
index 6a542ec8f..c5d091f32 100644
--- a/testing/tests/ikev2/nat-rw-psk/pretest.dat
+++ b/testing/tests/ikev2/nat-rw-psk/pretest.dat
@@ -1,7 +1,6 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+venus::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
alice::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev2/nat-rw-psk/test.conf b/testing/tests/ikev2/nat-rw-psk/test.conf
index 84317fd70..f515d4bc7 100644
--- a/testing/tests/ikev2/nat-rw-psk/test.conf
+++ b/testing/tests/ikev2/nat-rw-psk/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/ikev2/nat-rw/evaltest.dat b/testing/tests/ikev2/nat-rw/evaltest.dat
index e0b458dba..387dbae23 100644
--- a/testing/tests/ikev2/nat-rw/evaltest.dat
+++ b/testing/tests/ikev2/nat-rw/evaltest.dat
@@ -6,13 +6,13 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL, ESP in UDP::YES
sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL, ESP in UDP::YES
sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL, ESP in UDP::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
moon:: sleep 6::no output expected::NO
-bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP-encap: ESP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP-encap: ESP::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: isakmp-nat-keep-alive::YES
+bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP-encap: ESP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP-encap: ESP::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: isakmp-nat-keep-alive::YES
alice::cat /var/log/daemon.log::sending keep alive::YES
venus::cat /var/log/daemon.log::sending keep alive::YES
diff --git a/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw/hosts/sun/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/nat-rw/posttest.dat b/testing/tests/ikev2/nat-rw/posttest.dat
index 52572ece8..4643a3a7b 100644
--- a/testing/tests/ikev2/nat-rw/posttest.dat
+++ b/testing/tests/ikev2/nat-rw/posttest.dat
@@ -1,8 +1,8 @@
sun::ipsec stop
alice::ipsec stop
venus::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+venus::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/ikev2/nat-rw/pretest.dat b/testing/tests/ikev2/nat-rw/pretest.dat
index e365ff5c5..d701a1d61 100644
--- a/testing/tests/ikev2/nat-rw/pretest.dat
+++ b/testing/tests/ikev2/nat-rw/pretest.dat
@@ -1,7 +1,6 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+venus::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
alice::ipsec start
diff --git a/testing/tests/ikev2/nat-rw/test.conf b/testing/tests/ikev2/nat-rw/test.conf
index 84317fd70..f515d4bc7 100644
--- a/testing/tests/ikev2/nat-rw/test.conf
+++ b/testing/tests/ikev2/nat-rw/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/ikev2/nat-virtual-ip/evaltest.dat b/testing/tests/ikev2/nat-virtual-ip/evaltest.dat
index 9c98e312a..c60ffc772 100644
--- a/testing/tests/ikev2/nat-virtual-ip/evaltest.dat
+++ b/testing/tests/ikev2/nat-virtual-ip/evaltest.dat
@@ -1,7 +1,7 @@
moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: cat /var/log/daemon.log::inserted NAT rule mapping PH_IP_ALICE to virtual IP::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
bob::tcpdump::IP alice2.strongswan.org > bob.strongswan.org: ICMP::YES
diff --git a/testing/tests/ikev2/nat-virtual-ip/posttest.dat b/testing/tests/ikev2/nat-virtual-ip/posttest.dat
index ee30e2c59..11bd19da7 100644
--- a/testing/tests/ikev2/nat-virtual-ip/posttest.dat
+++ b/testing/tests/ikev2/nat-virtual-ip/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::conntrack -F
moon::rm /etc/nat_updown
diff --git a/testing/tests/ikev2/nat-virtual-ip/pretest.dat b/testing/tests/ikev2/nat-virtual-ip/pretest.dat
index abbca90d7..eb0c28c7f 100644
--- a/testing/tests/ikev2/nat-virtual-ip/pretest.dat
+++ b/testing/tests/ikev2/nat-virtual-ip/pretest.dat
@@ -1,7 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::conntrack -F
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/nat-virtual-ip/test.conf b/testing/tests/ikev2/nat-virtual-ip/test.conf
index 1971a33ab..f46f137b4 100644
--- a/testing/tests/ikev2/nat-virtual-ip/test.conf
+++ b/testing/tests/ikev2/nat-virtual-ip/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun bob"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-cert/evaltest.dat b/testing/tests/ikev2/net2net-cert/evaltest.dat
index c98f5d78d..2b37cad99 100644
--- a/testing/tests/ikev2/net2net-cert/evaltest.dat
+++ b/testing/tests/ikev2/net2net-cert/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-cert/posttest.dat b/testing/tests/ikev2/net2net-cert/posttest.dat
index a4c96e10f..837738fc6 100644
--- a/testing/tests/ikev2/net2net-cert/posttest.dat
+++ b/testing/tests/ikev2/net2net-cert/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/net2net-cert/pretest.dat b/testing/tests/ikev2/net2net-cert/pretest.dat
index 2d7a78acb..c724e5df8 100644
--- a/testing/tests/ikev2/net2net-cert/pretest.dat
+++ b/testing/tests/ikev2/net2net-cert/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/net2net-cert/test.conf b/testing/tests/ikev2/net2net-cert/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/ikev2/net2net-cert/test.conf
+++ b/testing/tests/ikev2/net2net-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-esn/posttest.dat b/testing/tests/ikev2/net2net-esn/posttest.dat
index a4c96e10f..837738fc6 100644
--- a/testing/tests/ikev2/net2net-esn/posttest.dat
+++ b/testing/tests/ikev2/net2net-esn/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/net2net-esn/pretest.dat b/testing/tests/ikev2/net2net-esn/pretest.dat
index 2d7a78acb..c724e5df8 100644
--- a/testing/tests/ikev2/net2net-esn/pretest.dat
+++ b/testing/tests/ikev2/net2net-esn/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/net2net-esn/test.conf b/testing/tests/ikev2/net2net-esn/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/ikev2/net2net-esn/test.conf
+++ b/testing/tests/ikev2/net2net-esn/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat b/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat
index 97dd63c5a..460c659d9 100644
--- a/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat
+++ b/testing/tests/ikev2/net2net-pgp-v3/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*71:27:04:32:cd:76:3a:18:
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun <sun.strongswan.org>.*71:27:04:32:cd:76:3a:18:02:0a:c9:88:c0:e7:5a:ed::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-pgp-v3/posttest.dat b/testing/tests/ikev2/net2net-pgp-v3/posttest.dat
index fafcde975..9a9513dc3 100644
--- a/testing/tests/ikev2/net2net-pgp-v3/posttest.dat
+++ b/testing/tests/ikev2/net2net-pgp-v3/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/certs/*
moon::rm /etc/ipsec.d/private/*
sun::rm /etc/ipsec.d/certs/*
diff --git a/testing/tests/ikev2/net2net-pgp-v3/pretest.dat b/testing/tests/ikev2/net2net-pgp-v3/pretest.dat
index 9e40684ab..0f4ae0f4f 100644
--- a/testing/tests/ikev2/net2net-pgp-v3/pretest.dat
+++ b/testing/tests/ikev2/net2net-pgp-v3/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
diff --git a/testing/tests/ikev2/net2net-pgp-v3/test.conf b/testing/tests/ikev2/net2net-pgp-v3/test.conf
index f74d0f7d6..afa2accbe 100644
--- a/testing/tests/ikev2/net2net-pgp-v3/test.conf
+++ b/testing/tests/ikev2/net2net-pgp-v3/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat b/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat
index 4615c3ed8..f74eb6a19 100644
--- a/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat
+++ b/testing/tests/ikev2/net2net-pgp-v4/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*b4:
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*b4:2f:31:fe:c8:0a:e3:26:4a:10:1c:85:97:7a:04:ac:8d:16:38:d3.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-pgp-v4/posttest.dat b/testing/tests/ikev2/net2net-pgp-v4/posttest.dat
index fafcde975..9a9513dc3 100644
--- a/testing/tests/ikev2/net2net-pgp-v4/posttest.dat
+++ b/testing/tests/ikev2/net2net-pgp-v4/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/certs/*
moon::rm /etc/ipsec.d/private/*
sun::rm /etc/ipsec.d/certs/*
diff --git a/testing/tests/ikev2/net2net-pgp-v4/pretest.dat b/testing/tests/ikev2/net2net-pgp-v4/pretest.dat
index 9e40684ab..0f4ae0f4f 100644
--- a/testing/tests/ikev2/net2net-pgp-v4/pretest.dat
+++ b/testing/tests/ikev2/net2net-pgp-v4/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
diff --git a/testing/tests/ikev2/net2net-pgp-v4/test.conf b/testing/tests/ikev2/net2net-pgp-v4/test.conf
index f74d0f7d6..afa2accbe 100644
--- a/testing/tests/ikev2/net2net-pgp-v4/test.conf
+++ b/testing/tests/ikev2/net2net-pgp-v4/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat b/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat
index 1556143cf..113c3d9c0 100644
--- a/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat
+++ b/testing/tests/ikev2/net2net-psk-dscp/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::dscp-be.*ESTABLISHED.*moon-be.*sun-be::YES
moon:: ipsec status 2> /dev/null::dscp-ef.*ESTABLISHED.*moon-ef.*sun-ef::YES
sun:: ipsec status 2> /dev/null::dscp-be.*ESTABLISHED.*sun-be.*moon-be::YES
sun:: ipsec status 2> /dev/null::dscp-ef.*ESTABLISHED.*sun-ef.*moon-ef::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-psk-dscp/posttest.dat b/testing/tests/ikev2/net2net-psk-dscp/posttest.dat
index d070c1443..21a22bfb8 100644
--- a/testing/tests/ikev2/net2net-psk-dscp/posttest.dat
+++ b/testing/tests/ikev2/net2net-psk-dscp/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
alice::iptables -t mangle -F OUTPUT
venus::iptables -t mangle -F OUTPUT
bob::iptables -t mangle -F OUTPUT
diff --git a/testing/tests/ikev2/net2net-psk-dscp/pretest.dat b/testing/tests/ikev2/net2net-psk-dscp/pretest.dat
index 058c24f8f..0495890dd 100644
--- a/testing/tests/ikev2/net2net-psk-dscp/pretest.dat
+++ b/testing/tests/ikev2/net2net-psk-dscp/pretest.dat
@@ -1,7 +1,7 @@
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
alice::iptables -t mangle -A OUTPUT -p icmp -j DSCP --set-dscp-class BE
venus::iptables -t mangle -A OUTPUT -p icmp -j DSCP --set-dscp-class EF
moon::iptables -t mangle -A PREROUTING -m dscp --dscp-class BE -j MARK --set-mark 10
diff --git a/testing/tests/ikev2/net2net-psk-dscp/test.conf b/testing/tests/ikev2/net2net-psk-dscp/test.conf
index 13a8a2a48..10c582c9b 100644
--- a/testing/tests/ikev2/net2net-psk-dscp/test.conf
+++ b/testing/tests/ikev2/net2net-psk-dscp/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-psk-fail/posttest.dat b/testing/tests/ikev2/net2net-psk-fail/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev2/net2net-psk-fail/posttest.dat
+++ b/testing/tests/ikev2/net2net-psk-fail/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/net2net-psk-fail/pretest.dat b/testing/tests/ikev2/net2net-psk-fail/pretest.dat
index 976a196db..cb9282595 100644
--- a/testing/tests/ikev2/net2net-psk-fail/pretest.dat
+++ b/testing/tests/ikev2/net2net-psk-fail/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
diff --git a/testing/tests/ikev2/net2net-psk-fail/test.conf b/testing/tests/ikev2/net2net-psk-fail/test.conf
index f6e064e7d..eb4822b5d 100644
--- a/testing/tests/ikev2/net2net-psk-fail/test.conf
+++ b/testing/tests/ikev2/net2net-psk-fail/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-psk/evaltest.dat b/testing/tests/ikev2/net2net-psk/evaltest.dat
index c98f5d78d..2b37cad99 100644
--- a/testing/tests/ikev2/net2net-psk/evaltest.dat
+++ b/testing/tests/ikev2/net2net-psk/evaltest.dat
@@ -2,6 +2,6 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets
index cbdddfb18..ba909a234 100644
--- a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets
@@ -8,5 +8,5 @@
: PSK 'My "home" is my "castle"!'
-192.168.0.1 : PSK "Andi's home"
+PH_IP_MOON : PSK "Andi's home"
diff --git a/testing/tests/ikev2/net2net-psk/posttest.dat b/testing/tests/ikev2/net2net-psk/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev2/net2net-psk/posttest.dat
+++ b/testing/tests/ikev2/net2net-psk/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/net2net-psk/pretest.dat b/testing/tests/ikev2/net2net-psk/pretest.dat
index 976a196db..cb9282595 100644
--- a/testing/tests/ikev2/net2net-psk/pretest.dat
+++ b/testing/tests/ikev2/net2net-psk/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
diff --git a/testing/tests/ikev2/net2net-psk/test.conf b/testing/tests/ikev2/net2net-psk/test.conf
index f74d0f7d6..afa2accbe 100644
--- a/testing/tests/ikev2/net2net-psk/test.conf
+++ b/testing/tests/ikev2/net2net-psk/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-pubkey/evaltest.dat b/testing/tests/ikev2/net2net-pubkey/evaltest.dat
index e47e709e2..bc03a39fb 100644
--- a/testing/tests/ikev2/net2net-pubkey/evaltest.dat
+++ b/testing/tests/ikev2/net2net-pubkey/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-pubkey/posttest.dat b/testing/tests/ikev2/net2net-pubkey/posttest.dat
index 65b18b7ca..675b02976 100644
--- a/testing/tests/ikev2/net2net-pubkey/posttest.dat
+++ b/testing/tests/ikev2/net2net-pubkey/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/private/moonKey.der
sun::rm /etc/ipsec.d/private/sunKey.der
moon::rm /etc/ipsec.d/certs/*.der
diff --git a/testing/tests/ikev2/net2net-pubkey/pretest.dat b/testing/tests/ikev2/net2net-pubkey/pretest.dat
index 9e40684ab..0f4ae0f4f 100644
--- a/testing/tests/ikev2/net2net-pubkey/pretest.dat
+++ b/testing/tests/ikev2/net2net-pubkey/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
diff --git a/testing/tests/ikev2/net2net-pubkey/test.conf b/testing/tests/ikev2/net2net-pubkey/test.conf
index f74d0f7d6..afa2accbe 100644
--- a/testing/tests/ikev2/net2net-pubkey/test.conf
+++ b/testing/tests/ikev2/net2net-pubkey/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-rfc3779/evaltest.dat b/testing/tests/ikev2/net2net-rfc3779/evaltest.dat
index 59d0372dc..e8e1a46e4 100644
--- a/testing/tests/ikev2/net2net-rfc3779/evaltest.dat
+++ b/testing/tests/ikev2/net2net-rfc3779/evaltest.dat
@@ -1,15 +1,15 @@
moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: cat /var/log/daemon.log::subject address block 10.2.0.0/16 is contained in issuer address block 10.1.0.0..10.2.255.255::YES
-moon:: cat /var/log/daemon.log::subject address block 192.168.0.2/32 is contained in issuer address block 192.168.0.0/24::YES
+moon:: cat /var/log/daemon.log::subject address block PH_IP_SUN/32 is contained in issuer address block 192.168.0.0/24::YES
moon:: cat /var/log/daemon.log::subject address block fec0:\:2/128 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES
moon:: cat /var/log/daemon.log::subject address block fec2:\:/16 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES
sun:: cat /var/log/daemon.log::subject address block 10.1.0.0/16 is contained in issuer address block 10.1.0.0..10.2.255.255::YES
-sun:: cat /var/log/daemon.log::subject address block 192.168.0.1/32 is contained in issuer address block 192.168.0.0/24::YES
+sun:: cat /var/log/daemon.log::subject address block PH_IP_MOON/32 is contained in issuer address block 192.168.0.0/24::YES
sun:: cat /var/log/daemon.log::subject address block fec0:\:1/128 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES
sun:: cat /var/log/daemon.log::subject address block fec1:\:/16 is contained in issuer address block fec0:\:..fec2:ffff:ffff:ffff:ffff:ffff:ffff:ffff::YES
moon:: cat /var/log/daemon.log::TS 10.2.0.0/16 is contained in address block constraint 10.2.0.0/16::YES
sun:: cat /var/log/daemon.log::TS 10.1.0.0/16 is contained in address block constraint 10.1.0.0/16::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-rfc3779/posttest.dat b/testing/tests/ikev2/net2net-rfc3779/posttest.dat
index a4c96e10f..837738fc6 100644
--- a/testing/tests/ikev2/net2net-rfc3779/posttest.dat
+++ b/testing/tests/ikev2/net2net-rfc3779/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/net2net-rfc3779/pretest.dat b/testing/tests/ikev2/net2net-rfc3779/pretest.dat
index 545a3690e..9fe2860b9 100644
--- a/testing/tests/ikev2/net2net-rfc3779/pretest.dat
+++ b/testing/tests/ikev2/net2net-rfc3779/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/net2net-rfc3779/test.conf b/testing/tests/ikev2/net2net-rfc3779/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/ikev2/net2net-rfc3779/test.conf
+++ b/testing/tests/ikev2/net2net-rfc3779/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-route/evaltest.dat b/testing/tests/ikev2/net2net-route/evaltest.dat
index 63d1cde24..77ab6e7c6 100644
--- a/testing/tests/ikev2/net2net-route/evaltest.dat
+++ b/testing/tests/ikev2/net2net-route/evaltest.dat
@@ -3,6 +3,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-route/posttest.dat b/testing/tests/ikev2/net2net-route/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev2/net2net-route/posttest.dat
+++ b/testing/tests/ikev2/net2net-route/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/net2net-route/pretest.dat b/testing/tests/ikev2/net2net-route/pretest.dat
index 2eef7de19..e4ee3fac2 100644
--- a/testing/tests/ikev2/net2net-route/pretest.dat
+++ b/testing/tests/ikev2/net2net-route/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 2
diff --git a/testing/tests/ikev2/net2net-route/test.conf b/testing/tests/ikev2/net2net-route/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/ikev2/net2net-route/test.conf
+++ b/testing/tests/ikev2/net2net-route/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-rsa/evaltest.dat b/testing/tests/ikev2/net2net-rsa/evaltest.dat
index e47e709e2..bc03a39fb 100644
--- a/testing/tests/ikev2/net2net-rsa/evaltest.dat
+++ b/testing/tests/ikev2/net2net-rsa/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-rsa/posttest.dat b/testing/tests/ikev2/net2net-rsa/posttest.dat
index a199946aa..f7fe7dc48 100644
--- a/testing/tests/ikev2/net2net-rsa/posttest.dat
+++ b/testing/tests/ikev2/net2net-rsa/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/private/moonKey.der
sun::rm /etc/ipsec.d/private/sunKey.der
diff --git a/testing/tests/ikev2/net2net-rsa/pretest.dat b/testing/tests/ikev2/net2net-rsa/pretest.dat
index 9e40684ab..0f4ae0f4f 100644
--- a/testing/tests/ikev2/net2net-rsa/pretest.dat
+++ b/testing/tests/ikev2/net2net-rsa/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
sun::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
diff --git a/testing/tests/ikev2/net2net-rsa/test.conf b/testing/tests/ikev2/net2net-rsa/test.conf
index f74d0f7d6..afa2accbe 100644
--- a/testing/tests/ikev2/net2net-rsa/test.conf
+++ b/testing/tests/ikev2/net2net-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-same-nets/evaltest.dat b/testing/tests/ikev2/net2net-same-nets/evaltest.dat
index 1ca7e2d60..3b479cefa 100644
--- a/testing/tests/ikev2/net2net-same-nets/evaltest.dat
+++ b/testing/tests/ikev2/net2net-same-nets/evaltest.dat
@@ -2,8 +2,8 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 10.6.0.10::64 bytes from 10.6.0.10: icmp_seq=1::YES
-bob:: ping -c 1 10.9.0.10::64 bytes from 10.9.0.10: icmp_seq=1::YES
+alice::ping -c 1 10.6.0.10::64 bytes from 10.6.0.10: icmp_req=1::YES
+bob:: ping -c 1 10.9.0.10::64 bytes from 10.9.0.10: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
bob::tcpdump::IP 10.9.0.10 > bob.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown b/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown
index c64158a2f..bdba3fb05 100755
--- a/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown
+++ b/testing/tests/ikev2/net2net-same-nets/hosts/sun/etc/mark_updown
@@ -73,8 +73,12 @@
# just the host, this will be 255.255.255.255.
#
# PLUTO_MY_SOURCEIP
-# if non-empty, then the source address for the route will be
-# set to this IP address.
+# PLUTO_MY_SOURCEIP4_$i
+# PLUTO_MY_SOURCEIP6_$i
+# contains IPv4/IPv6 virtual IP received from a responder,
+# $i enumerates from 1 to the number of IP per address family.
+# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first
+# virtual IP, IPv4 or IPv6.
#
# PLUTO_MY_PROTOCOL
# is the IP protocol that will be transported.
@@ -128,9 +132,15 @@
# contains the remote UDP port in the case of ESP_IN_UDP
# encapsulation
#
+# PLUTO_DNS4_$i
+# PLUTO_DNS6_$i
+# contains IPv4/IPv6 DNS server attribute received from a
+# responder, $i enumerates from 1 to the number of servers per
+# address family.
+#
# define a minimum PATH environment in case it is not set
-PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin"
+PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin"
export PATH
# check parameter(s)
@@ -196,8 +206,8 @@ up-client:)
iptables -t nat -A PREROUTING -i $INT_INTERFACE -m mark --mark $PLUTO_MARK_OUT \
-d $OUT_NET -j NETMAP --to $SAME_NET
iptables -I FORWARD 1 -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT -j ACCEPT
- iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \
- -s $SAME_NET -j NETMAP --to $IN_NET
+ iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \
+ -s $SAME_NET -j NETMAP --to $IN_NET
fi
;;
down-client:)
@@ -215,7 +225,11 @@ down-client:)
if [ -n "$PLUTO_MARK_OUT" ]
then
iptables -t mangle -D PREROUTING $SET_MARK_OUT
+ iptables -t nat -D PREROUTING -i $INT_INTERFACE -m mark --mark $PLUTO_MARK_OUT \
+ -d $OUT_NET -j NETMAP --to $SAME_NET
iptables -D FORWARD -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT -j ACCEPT
+ iptables -t nat -D POSTROUTING -o $PLUTO_INTERFACE -m mark --mark $PLUTO_MARK_OUT \
+ -s $SAME_NET -j NETMAP --to $IN_NET
fi
;;
*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
diff --git a/testing/tests/ikev2/net2net-same-nets/posttest.dat b/testing/tests/ikev2/net2net-same-nets/posttest.dat
index e75e66650..b0225c37e 100644
--- a/testing/tests/ikev2/net2net-same-nets/posttest.dat
+++ b/testing/tests/ikev2/net2net-same-nets/posttest.dat
@@ -2,6 +2,6 @@ sun::iptables -t mangle -n -v -L PREROUTING
sun::iptables -t nat -n -v -L
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
sun::conntrack -F
diff --git a/testing/tests/ikev2/net2net-same-nets/pretest.dat b/testing/tests/ikev2/net2net-same-nets/pretest.dat
index 2d7a78acb..c724e5df8 100644
--- a/testing/tests/ikev2/net2net-same-nets/pretest.dat
+++ b/testing/tests/ikev2/net2net-same-nets/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/net2net-same-nets/test.conf b/testing/tests/ikev2/net2net-same-nets/test.conf
index 1971a33ab..f46f137b4 100644
--- a/testing/tests/ikev2/net2net-same-nets/test.conf
+++ b/testing/tests/ikev2/net2net-same-nets/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun bob"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-start/evaltest.dat b/testing/tests/ikev2/net2net-start/evaltest.dat
index dbd06104f..f003f822f 100644
--- a/testing/tests/ikev2/net2net-start/evaltest.dat
+++ b/testing/tests/ikev2/net2net-start/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-start/posttest.dat b/testing/tests/ikev2/net2net-start/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/ikev2/net2net-start/posttest.dat
+++ b/testing/tests/ikev2/net2net-start/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/net2net-start/pretest.dat b/testing/tests/ikev2/net2net-start/pretest.dat
index 8f3d17207..9d23c553e 100644
--- a/testing/tests/ikev2/net2net-start/pretest.dat
+++ b/testing/tests/ikev2/net2net-start/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
sun::ipsec start
sun::sleep 2
moon::ipsec start
diff --git a/testing/tests/ikev2/net2net-start/test.conf b/testing/tests/ikev2/net2net-start/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/ikev2/net2net-start/test.conf
+++ b/testing/tests/ikev2/net2net-start/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
index dda793f44..4e2cc2860 100755
--- a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
+++ b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -5,7 +5,7 @@ cd /etc/openssl
echo "Content-type: application/ocsp-response"
echo ""
-/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
- -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \
- -resp_no_certs -nmin 5 \
- -reqin /dev/stdin -respout /dev/stdout
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+ -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \
+ -resp_no_certs -nmin 5 \
+ -reqin /dev/stdin -respout /dev/stdout | cat
diff --git a/testing/tests/ikev2/ocsp-local-cert/test.conf b/testing/tests/ikev2/ocsp-local-cert/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/ocsp-local-cert/test.conf
+++ b/testing/tests/ikev2/ocsp-local-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-multi-level/pretest.dat b/testing/tests/ikev2/ocsp-multi-level/pretest.dat
index f15265e32..86dd31e83 100644
--- a/testing/tests/ikev2/ocsp-multi-level/pretest.dat
+++ b/testing/tests/ikev2/ocsp-multi-level/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/ocsp-multi-level/test.conf b/testing/tests/ikev2/ocsp-multi-level/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev2/ocsp-multi-level/test.conf
+++ b/testing/tests/ikev2/ocsp-multi-level/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
index 74d22b90d..429061376 100755
--- a/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
+++ b/testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -5,7 +5,7 @@ cd /etc/openssl
echo "Content-type: application/ocsp-response"
echo ""
-/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
- -rkey winnetouKey.pem -rsigner winnetouCert.pem \
- -nmin 5 \
- -reqin /dev/stdin -respout /dev/stdout
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+ -rkey winnetouKey.pem -rsigner winnetouCert.pem \
+ -nmin 5 \
+ -reqin /dev/stdin -respout /dev/stdout | cat
diff --git a/testing/tests/ikev2/ocsp-no-signer-cert/test.conf b/testing/tests/ikev2/ocsp-no-signer-cert/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/ocsp-no-signer-cert/test.conf
+++ b/testing/tests/ikev2/ocsp-no-signer-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-revoked/test.conf b/testing/tests/ikev2/ocsp-revoked/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/ocsp-revoked/test.conf
+++ b/testing/tests/ikev2/ocsp-revoked/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
index e998b6ad0..59c356302 100755
--- a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
+++ b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -5,7 +5,7 @@ cd /etc/openssl
echo "Content-type: application/ocsp-response"
echo ""
-/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
- -rkey strongswanKey.pem -rsigner strongswanCert.pem \
- -resp_no_certs -nmin 5 \
- -reqin /dev/stdin -respout /dev/stdout
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+ -rkey strongswanKey.pem -rsigner strongswanCert.pem \
+ -resp_no_certs -nmin 5 \
+ -reqin /dev/stdin -respout /dev/stdout | cat
diff --git a/testing/tests/ikev2/ocsp-root-cert/test.conf b/testing/tests/ikev2/ocsp-root-cert/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/ocsp-root-cert/test.conf
+++ b/testing/tests/ikev2/ocsp-root-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-signer-cert/test.conf b/testing/tests/ikev2/ocsp-signer-cert/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/ocsp-signer-cert/test.conf
+++ b/testing/tests/ikev2/ocsp-signer-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat b/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat
index f15265e32..86dd31e83 100644
--- a/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat
+++ b/testing/tests/ikev2/ocsp-strict-ifuri/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/ocsp-strict-ifuri/test.conf b/testing/tests/ikev2/ocsp-strict-ifuri/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev2/ocsp-strict-ifuri/test.conf
+++ b/testing/tests/ikev2/ocsp-strict-ifuri/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
index 92aa920aa..aa70321d5 100755
--- a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
+++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -6,9 +6,9 @@ echo "Content-type: application/ocsp-response"
echo ""
# simulate a delayed response
-sleep 5
+sleep 5
-/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
- -rkey ocspKey.pem -rsigner ocspCert.pem \
- -nmin 5 \
- -reqin /dev/stdin -respout /dev/stdout
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+ -rkey ocspKey.pem -rsigner ocspCert.pem \
+ -nmin 5 \
+ -reqin /dev/stdin -respout /dev/stdout | cat
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/test.conf b/testing/tests/ikev2/ocsp-timeouts-good/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/ocsp-timeouts-good/test.conf
+++ b/testing/tests/ikev2/ocsp-timeouts-good/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf
+++ b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
index 20c4b2a22..72aa7a6c4 100755
--- a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -5,7 +5,7 @@ cd /etc/openssl
echo "Content-type: application/ocsp-response"
echo ""
-/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
- -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \
- -nmin 5 \
- -reqin /dev/stdin -respout /dev/stdout
+cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+ -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \
+ -nmin 5 \
+ -reqin /dev/stdin -respout /dev/stdout | cat
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf
index 2b240d895..892f51cd9 100644
--- a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon carol winnetou"
+VIRTHOSTS="moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/protoport-dual/evaltest.dat b/testing/tests/ikev2/protoport-dual/evaltest.dat
index a65460cc8..cf45f3b52 100644
--- a/testing/tests/ikev2/protoport-dual/evaltest.dat
+++ b/testing/tests/ikev2/protoport-dual/evaltest.dat
@@ -2,8 +2,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/protoport-dual/posttest.dat b/testing/tests/ikev2/protoport-dual/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/protoport-dual/posttest.dat
+++ b/testing/tests/ikev2/protoport-dual/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/protoport-dual/pretest.dat b/testing/tests/ikev2/protoport-dual/pretest.dat
index d3d0061c3..efb2e5712 100644
--- a/testing/tests/ikev2/protoport-dual/pretest.dat
+++ b/testing/tests/ikev2/protoport-dual/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 2
diff --git a/testing/tests/ikev2/protoport-dual/test.conf b/testing/tests/ikev2/protoport-dual/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/protoport-dual/test.conf
+++ b/testing/tests/ikev2/protoport-dual/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/protoport-route/evaltest.dat b/testing/tests/ikev2/protoport-route/evaltest.dat
index 83a5e1bde..75c547995 100644
--- a/testing/tests/ikev2/protoport-route/evaltest.dat
+++ b/testing/tests/ikev2/protoport-route/evaltest.dat
@@ -1,5 +1,5 @@
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES
-carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req::YES
carol::ssh PH_IP_ALICE hostname::alice::YES
carol::cat /var/log/daemon.log::creating acquire job::YES
carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED::YES
diff --git a/testing/tests/ikev2/protoport-route/posttest.dat b/testing/tests/ikev2/protoport-route/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/protoport-route/posttest.dat
+++ b/testing/tests/ikev2/protoport-route/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/protoport-route/pretest.dat b/testing/tests/ikev2/protoport-route/pretest.dat
index 0aded0f4d..5a15574d6 100644
--- a/testing/tests/ikev2/protoport-route/pretest.dat
+++ b/testing/tests/ikev2/protoport-route/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/protoport-route/test.conf b/testing/tests/ikev2/protoport-route/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/protoport-route/test.conf
+++ b/testing/tests/ikev2/protoport-route/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/reauth-early/evaltest.dat b/testing/tests/ikev2/reauth-early/evaltest.dat
index 1d3a35916..dbc6f8d97 100644
--- a/testing/tests/ikev2/reauth-early/evaltest.dat
+++ b/testing/tests/ikev2/reauth-early/evaltest.dat
@@ -1,6 +1,6 @@
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home\[2]: ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::cat /var/log/daemon.log::received AUTH_LIFETIME of 30s, scheduling reauthentication in 25s::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/reauth-early/posttest.dat b/testing/tests/ikev2/reauth-early/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/reauth-early/posttest.dat
+++ b/testing/tests/ikev2/reauth-early/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/reauth-early/pretest.dat b/testing/tests/ikev2/reauth-early/pretest.dat
index 7ed2423be..153ea7c43 100644
--- a/testing/tests/ikev2/reauth-early/pretest.dat
+++ b/testing/tests/ikev2/reauth-early/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/reauth-early/test.conf b/testing/tests/ikev2/reauth-early/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/reauth-early/test.conf
+++ b/testing/tests/ikev2/reauth-early/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/reauth-late/evaltest.dat b/testing/tests/ikev2/reauth-late/evaltest.dat
index d86758f9a..205a4d9e7 100644
--- a/testing/tests/ikev2/reauth-late/evaltest.dat
+++ b/testing/tests/ikev2/reauth-late/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*caro
carol::ipsec status 2> /dev/null::home\[2]: ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::cat /var/log/daemon.log::scheduling reauthentication in 2[0-5]s::YES
carol::cat /var/log/daemon.log::received AUTH_LIFETIME of 360[01]s, reauthentication already scheduled in 2[0-5]s::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/reauth-late/posttest.dat b/testing/tests/ikev2/reauth-late/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/reauth-late/posttest.dat
+++ b/testing/tests/ikev2/reauth-late/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/reauth-late/pretest.dat b/testing/tests/ikev2/reauth-late/pretest.dat
index 7ed2423be..153ea7c43 100644
--- a/testing/tests/ikev2/reauth-late/pretest.dat
+++ b/testing/tests/ikev2/reauth-late/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/reauth-late/test.conf b/testing/tests/ikev2/reauth-late/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/reauth-late/test.conf
+++ b/testing/tests/ikev2/reauth-late/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-cert/evaltest.dat b/testing/tests/ikev2/rw-cert/evaltest.dat
index f8cfb111b..ba661975b 100644
--- a/testing/tests/ikev2/rw-cert/evaltest.dat
+++ b/testing/tests/ikev2/rw-cert/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-cert/posttest.dat b/testing/tests/ikev2/rw-cert/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-cert/posttest.dat
+++ b/testing/tests/ikev2/rw-cert/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-cert/pretest.dat b/testing/tests/ikev2/rw-cert/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev2/rw-cert/pretest.dat
+++ b/testing/tests/ikev2/rw-cert/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-cert/test.conf b/testing/tests/ikev2/rw-cert/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-cert/test.conf
+++ b/testing/tests/ikev2/rw-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat
index a39bf3afe..d59eef513 100644
--- a/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/evaltest.dat
@@ -7,7 +7,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat
index ed5498bfe..388339fb8 100644
--- a/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf b/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf
index 2bd21499b..e093d43d8 100644
--- a/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf
+++ b/testing/tests/ikev2/rw-eap-aka-id-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat
index 2abfdd19b..0ea4e21ab 100644
--- a/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-aka-rsa/evaltest.dat
@@ -6,7 +6,7 @@ moon:: ipsec status 2> /dev/null::rw-eap-aka.*ESTABLISHED.*moon.strongswan.org.*
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap-aka.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-aka-rsa/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat
index ed5498bfe..388339fb8 100644
--- a/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-aka-rsa/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-aka-rsa/test.conf b/testing/tests/ikev2/rw-eap-aka-rsa/test.conf
index 2bd21499b..e093d43d8 100644
--- a/testing/tests/ikev2/rw-eap-aka-rsa/test.conf
+++ b/testing/tests/ikev2/rw-eap-aka-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat b/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat
index 9c6ae73e9..6a20b8e8c 100644
--- a/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-dynamic/evaltest.dat
@@ -15,8 +15,8 @@ moon:: ipsec status 2> /dev/null::rw-eap[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-eap[{]2}.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-dynamic/posttest.dat b/testing/tests/ikev2/rw-eap-dynamic/posttest.dat
index 1777f439f..b757d8b15 100644
--- a/testing/tests/ikev2/rw-eap-dynamic/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-dynamic/posttest.dat
@@ -1,6 +1,6 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-dynamic/pretest.dat b/testing/tests/ikev2/rw-eap-dynamic/pretest.dat
index 369596177..17f1b5f2b 100644
--- a/testing/tests/ikev2/rw-eap-dynamic/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-dynamic/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-dynamic/test.conf b/testing/tests/ikev2/rw-eap-dynamic/test.conf
index a71d09e9d..a5525e6aa 100644
--- a/testing/tests/ikev2/rw-eap-dynamic/test.conf
+++ b/testing/tests/ikev2/rw-eap-dynamic/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/description.txt b/testing/tests/ikev2/rw-eap-md5-class-radius/description.txt
new file mode 100644
index 000000000..6860700db
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/description.txt
@@ -0,0 +1,9 @@
+The roadwarriors <b>carol</b> an <b>dave</b> set up a connection to gateway
+<b>moon</b>. At the outset the gateway authenticates itself to the client by
+sending an IKEv2 <b>RSA signature</b> accompanied by a certificate.
+<b>carol</b> and <b>dave</b> then use the <b>EAP-MD5</b> protocol to authenticate
+against the gateway <b>moon</b>. The user credentials of <b>carol</b>
+and <b>dave</b> are kept both on the local clients and the RADIUS server <b>alice</b>.
+<b>carol</b> possesses the RADIUS class attribute <b>Research</b> and therefore obtains
+access to the <b>research</b> subnet behind gateway <b>moon</b> whereas <b>dave</b>
+belongs to the class <b>Accounting</b> and has access to the <b>acccess</b> subnet.
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat
new file mode 100644
index 000000000..aa6d4291b
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/evaltest.dat
@@ -0,0 +1,26 @@
+carol::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with RSA signature successful::YES
+moon ::cat /var/log/daemon.log::received EAP identity .*carol::YES
+carol::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
+carol::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with EAP successful::YES
+moon ::cat /var/log/daemon.log::authentication of .*PH_IP_CAROL.* with EAP successful::YES
+moon ::ipsec status 2> /dev/null::research.*ESTABLISHED.*moon.strongswan.org.*PH_IP_CAROL::YES
+carol::ipsec status 2> /dev/null::alice.*ESTABLISHED.*PH_IP_CAROL.*moon.strongswan.org::YES
+moon ::ipsec status 2> /dev/null::research.*INSTALLED, TUNNEL::YES
+carol::ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::YES
+carol::ipsec status 2> /dev/null::venus.*INSTALLED, TUNNEL::NO
+dave ::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with RSA signature successful::YES
+moon ::cat /var/log/daemon.log::received EAP identity .*dave::YES
+dave ::cat /var/log/daemon.log::server requested EAP_MD5 authentication::YES
+dave ::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with EAP successful::YES
+moon ::cat /var/log/daemon.log::authentication of .*PH_IP_DAVE.* with EAP successful::YES
+moon ::ipsec status 2> /dev/null::accounting.*ESTABLISHED.*moon.strongswan.org.*PH_IP_DAVE::YES
+dave ::ipsec status 2> /dev/null::alice.*ESTABLISHED.*PH_IP_DAVE.*moon.strongswan.org::YES
+moon ::ipsec status 2> /dev/null::accounting.*INSTALLED, TUNNEL::YES
+dave ::ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::NO
+dave ::ipsec status 2> /dev/null::venus.*INSTALLED, TUNNEL::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/eap.conf
index 623f42904..623f42904 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/eap.conf
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/proxy.conf
index 783587b55..783587b55 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/sites-available/default
index 2de32a6f2..a67a5dcb4 100644
--- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -40,4 +40,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users
new file mode 100644
index 000000000..62d459115
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/alice/etc/freeradius/users
@@ -0,0 +1,4 @@
+carol Cleartext-Password := "Ar3etTnp"
+ Class = "Research"
+dave Cleartext-Password := "W7R0g3do"
+ Class = "Accounting"
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.conf
new file mode 100644
index 000000000..53e2be638
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+ keyexchange=ikev2
+
+conn alice
+ rightsubnet=10.1.0.10/32
+ also=home
+ auto=add
+
+conn venus
+ rightsubnet=10.1.0.20/32
+ also=home
+ auto=add
+
+conn home
+ left=%any
+ leftauth=eap
+ leftfirewall=yes
+ eap_identity=carol
+ right=PH_IP_MOON
+ rightid=@moon.strongswan.org
+ rightauth=pubkey
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..23d79cf2e
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+carol : EAP "Ar3etTnp"
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/strongswan.conf
new file mode 100644
index 000000000..b1b418060
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/carol/etc/strongswan.conf
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default fips-prf eap-md5 eap-identity updown
+}
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.conf
new file mode 100644
index 000000000..9428f323a
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+ keyexchange=ikev2
+
+conn alice
+ rightsubnet=10.1.0.10/32
+ also=home
+ auto=add
+
+conn venus
+ rightsubnet=10.1.0.20/32
+ also=home
+ auto=add
+
+conn home
+ left=%any
+ leftauth=eap
+ leftfirewall=yes
+ eap_identity=dave
+ right=PH_IP_MOON
+ rightid=@moon.strongswan.org
+ rightauth=pubkey
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.secrets
new file mode 100644
index 000000000..02e0c9963
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+dave : EAP "W7R0g3do"
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/strongswan.conf
new file mode 100644
index 000000000..b1b418060
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/dave/etc/strongswan.conf
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default fips-prf eap-md5 eap-identity updown
+}
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.conf
new file mode 100644
index 000000000..9dcbcca75
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,33 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+ keyexchange=ikev2
+
+conn research
+ rightgroups=Research
+ leftsubnet=10.1.0.0/28
+ also=rw-eap
+ auto=add
+
+conn accounting
+ rightgroups=Accounting
+ leftsubnet=10.1.0.16/28
+ also=rw-eap
+ auto=add
+
+conn rw-eap
+ left=PH_IP_MOON
+ leftid=@moon.strongswan.org
+ leftcert=moonCert.pem
+ leftauth=pubkey
+ leftfirewall=yes
+ rightsendcert=never
+ rightauth=eap-radius
+ eap_identity=%any
+ right=%any
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..e86d6aa5c
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA moonKey.pem
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/strongswan.conf
new file mode 100644
index 000000000..4297a3056
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/hosts/moon/etc/strongswan.conf
@@ -0,0 +1,12 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default fips-prf eap-radius eap-identity updown
+ plugins {
+ eap-radius {
+ class_group = yes
+ secret = gv6URkSs
+ server = PH_IP_ALICE
+ }
+ }
+}
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat
new file mode 100644
index 000000000..670d2e72f
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/posttest.dat
@@ -0,0 +1,7 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat
new file mode 100644
index 000000000..a2704e833
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/pretest.dat
@@ -0,0 +1,13 @@
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+alice::radiusd
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up alice
+carol::ipsec up venus
+dave::ipsec up alice
+dave::ipsec up venus
+dave::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf
new file mode 100644
index 000000000..5dfb41723
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-class-radius/test.conf
@@ -0,0 +1,26 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="alice venus moon carol winnetou moon"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-c-w-d.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
+
+# Guest instances on which FreeRadius is started
+#
+RADIUSHOSTS="alice"
+
diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat
index a239b56e7..42d2c319e 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/evaltest.dat
@@ -2,13 +2,13 @@ carol::cat /var/log/daemon.log::configured EAP-Identity carol::YES
carol::cat /var/log/daemon.log::added EAP secret for carol moon.strongswan.org::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
-moon:: cat /var/log/daemon.log::authentication of '192.168.0.100' with EAP successful::YES
+moon:: cat /var/log/daemon.log::authentication of 'PH_IP_CAROL' with EAP successful::YES
moon:: cat /var/log/daemon.log::received EAP identity.*carol::YES
-moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[192.168.0.100]::YES
-carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*moon.strongswan.org::YES
+moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[PH_IP_CAROL]::YES
+carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat b/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat
index 9c301f484..180537f5f 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf b/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf
index 2bd21499b..e093d43d8 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf
+++ b/testing/tests/ikev2/rw-eap-md5-id-prompt/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat
index 73f606be3..8f813395a 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/evaltest.dat
@@ -7,7 +7,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/eap.conf
index 623f42904..623f42904 100644
--- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/eap.conf
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/proxy.conf
index 783587b55..783587b55 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/sites-available/default
index 2de32a6f2..a67a5dcb4 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -40,4 +40,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/users
index 247b918e3..247b918e3 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index 1143a0473..000000000
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,120 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat
index 920d6a20d..181949fb5 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
carol::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat
index 280d62e3c..9adc43d3e 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+alice::radiusd
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf
index e0d77b583..eb1e15dd2 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat
index 525d987af..a8019b3e7 100644
--- a/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-radius/evaltest.dat
@@ -6,6 +6,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf
index 623f42904..623f42904 100644
--- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/eap.conf
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default
index 802fcfd8d..dd0825858 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -41,4 +41,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/users
index 247b918e3..247b918e3 100644
--- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index 1143a0473..000000000
--- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,120 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-md5-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat b/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat
index 920d6a20d..181949fb5 100644
--- a/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-radius/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
carol::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat b/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat
index 280d62e3c..9adc43d3e 100644
--- a/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-radius/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+alice::radiusd
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/test.conf b/testing/tests/ikev2/rw-eap-md5-radius/test.conf
index e0d77b583..eb1e15dd2 100644
--- a/testing/tests/ikev2/rw-eap-md5-radius/test.conf
+++ b/testing/tests/ikev2/rw-eap-md5-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat
index dd67704eb..84f41fd93 100644
--- a/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-rsa/evaltest.dat
@@ -5,7 +5,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-rsa/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat
index ed5498bfe..388339fb8 100644
--- a/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-md5-rsa/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-md5-rsa/test.conf b/testing/tests/ikev2/rw-eap-md5-rsa/test.conf
index 2bd21499b..e093d43d8 100644
--- a/testing/tests/ikev2/rw-eap-md5-rsa/test.conf
+++ b/testing/tests/ikev2/rw-eap-md5-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat
index eafd09b80..010f48315 100644
--- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/evaltest.dat
@@ -3,11 +3,11 @@ carol::cat /var/log/daemon.log::server requested EAP_MSCHAPV2 authentication::YE
carol::cat /var/log/daemon.log::authentication of .*moon.strongswan.org.* with EAP successful::YES
moon:: cat /var/log/daemon.log::received EAP identity.*carol::YES
moon:: cat /var/log/daemon.log::authentication of .*PH_IP_CAROL.* with EAP successful::YES
-moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[192.168.0.100]::YES
-carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*moon.strongswan.org::YES
+moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*\[PH_IP_CAROL]::YES
+carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat
index ed5498bfe..388339fb8 100644
--- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf
index 2bd21499b..e093d43d8 100644
--- a/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf
+++ b/testing/tests/ikev2/rw-eap-mschapv2-id-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat
index 871d3b931..4ed5257b1 100644
--- a/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-md5/evaltest.dat
@@ -18,6 +18,6 @@ moon:: ipsec status 2> /dev/null::rw-eap[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-eap[{]2}.*INSTALLED::NO
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED::NO
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat b/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-md5/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat b/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat
index 369596177..17f1b5f2b 100644
--- a/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-md5/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-peap-md5/test.conf b/testing/tests/ikev2/rw-eap-peap-md5/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-eap-peap-md5/test.conf
+++ b/testing/tests/ikev2/rw-eap-peap-md5/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat
index 643b2c39d..fc75e1c9a 100644
--- a/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/evaltest.dat
@@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@stronswan.org::NO
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat b/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat
index 369596177..17f1b5f2b 100644
--- a/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf b/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf
+++ b/testing/tests/ikev2/rw-eap-peap-mschapv2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat
index 81244bd85..95c29b7f5 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-radius/evaltest.dat
@@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/eap.conf
index df50901d5..11d3e2acd 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/eap.conf
@@ -1,7 +1,7 @@
eap {
md5 {
}
- default_eap_type = peap
+ default_eap_type = peap
tls {
private_key_file = /etc/raddb/certs/aaaKey.pem
certificate_file = /etc/raddb/certs/aaaCert.pem
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/default
index 802fcfd8d..dd0825858 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -41,4 +41,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel
index e088fae14..e088fae14 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel
+++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/users
index 50ccf3e76..50ccf3e76 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-peap-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat b/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat
index dbe56013a..670d2e72f 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-radius/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat b/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat
index cbe1ae229..3e7fc0bb1 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-peap-radius/pretest.dat
@@ -1,7 +1,7 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+alice::radiusd
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-peap-radius/test.conf b/testing/tests/ikev2/rw-eap-peap-radius/test.conf
index e6a786a94..20d586309 100644
--- a/testing/tests/ikev2/rw-eap-peap-radius/test.conf
+++ b/testing/tests/ikev2/rw-eap-peap-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol winnetou dave moon"
+VIRTHOSTS="alice carol winnetou dave moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat
index 7f1def4a5..f1a68bc19 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/evaltest.dat
@@ -7,6 +7,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*caro
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf
new file mode 100644
index 000000000..7d8023951
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/eap.conf
@@ -0,0 +1,5 @@
+eap {
+ default_eap_type = sim
+ sim {
+ }
+}
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files
new file mode 100644
index 000000000..10c26aa15
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/modules/sim_files
@@ -0,0 +1,3 @@
+sim_files {
+ simtriplets = "/etc/freeradius/triplets.dat"
+}
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/proxy.conf
index 783587b55..783587b55 100644
--- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/sites-available/default
index 92896b11e..893529324 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -40,4 +40,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/triplets.dat
index c167ba940..c167ba940 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/triplets.dat
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/triplets.dat
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/users
index e69de29bb..e69de29bb 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf
deleted file mode 100644
index a2020424e..000000000
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/eap.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-eap {
- default_eap_type = sim
- sim {
- }
-}
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index d77b818fe..000000000
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,123 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
- sim_files {
- simtriplets = "/etc/raddb/triplets.dat"
- }
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat
index 920d6a20d..181949fb5 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
carol::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat
index 0da980c07..b9117af36 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/pretest.dat
@@ -1,7 +1,7 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-alice::cat /etc/raddb/triplets.dat
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+alice::cat /etc/freeradius/triplets.dat
+alice::radiusd
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf
index e0d77b583..eb1e15dd2 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat
index f2654766a..f434ddfc6 100644
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/evaltest.dat
@@ -4,7 +4,7 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP
moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES
@@ -12,4 +12,4 @@ moon:: cat /var/log/daemon.log::EAP method EAP_SIM failed for peer dave@strongsw
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO
dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf
new file mode 100644
index 000000000..7d8023951
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/eap.conf
@@ -0,0 +1,5 @@
+eap {
+ default_eap_type = sim
+ sim {
+ }
+}
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files
new file mode 100644
index 000000000..10c26aa15
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/modules/sim_files
@@ -0,0 +1,3 @@
+sim_files {
+ simtriplets = "/etc/freeradius/triplets.dat"
+}
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/sites-available/default
index 126d61d05..fbdf75f4c 100644
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -41,4 +41,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/triplets.dat
index fd0eb19b9..3e9a644eb 100644
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/triplets.dat
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/triplets.dat
@@ -4,4 +4,3 @@ carol@strongswan.org,32000000000000000000000000000000,32112233,325566778899AABB
dave@strongswan.org,33000000000000000000000000000000,33112233,335566778899AABB
dave@strongswan.org,34000000000000000000000000000000,34112233,345566778899AABB
dave@strongswan.org,35000000000000000000000000000000,35112233,355566778899AABB
-
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/users
index e69de29bb..e69de29bb 100644
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf
deleted file mode 100644
index a2020424e..000000000
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/eap.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-eap {
- default_eap_type = sim
- sim {
- }
-}
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index d77b818fe..000000000
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,123 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
- sim_files {
- simtriplets = "/etc/raddb/triplets.dat"
- }
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat
index dbe56013a..670d2e72f 100644
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat
index 5a51733dc..0b3e901c2 100644
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/pretest.dat
@@ -1,11 +1,11 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
-alice::cat /etc/raddb/triplets.dat
-alice::/etc/init.d/radiusd start
+alice::cat /etc/freeradius/triplets.dat
+alice::radiusd
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf
index bb6b68687..29bfaa78c 100644
--- a/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf
+++ b/testing/tests/ikev2/rw-eap-sim-only-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat
index 8e12c29d0..21cfe429a 100644
--- a/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-radius/evaltest.dat
@@ -4,7 +4,7 @@ carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP
moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES
@@ -12,4 +12,4 @@ moon:: cat /var/log/daemon.log::EAP method EAP_SIM failed for peer dave@strongsw
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO
dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf
new file mode 100644
index 000000000..7d8023951
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/eap.conf
@@ -0,0 +1,5 @@
+eap {
+ default_eap_type = sim
+ sim {
+ }
+}
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/sites-available/default
index dfceb037d..91425f812 100644
--- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -59,4 +59,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/triplets.dat b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/triplets.dat
index fd0eb19b9..3e9a644eb 100644
--- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/triplets.dat
+++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/triplets.dat
@@ -4,4 +4,3 @@ carol@strongswan.org,32000000000000000000000000000000,32112233,325566778899AABB
dave@strongswan.org,33000000000000000000000000000000,33112233,335566778899AABB
dave@strongswan.org,34000000000000000000000000000000,34112233,345566778899AABB
dave@strongswan.org,35000000000000000000000000000000,35112233,355566778899AABB
-
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/users
index e69de29bb..e69de29bb 100644
--- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf
deleted file mode 100644
index a2020424e..000000000
--- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/eap.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-eap {
- default_eap_type = sim
- sim {
- }
-}
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index d77b818fe..000000000
--- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,123 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
- sim_files {
- simtriplets = "/etc/raddb/triplets.dat"
- }
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-sim-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat b/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat
index dbe56013a..670d2e72f 100644
--- a/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-radius/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat b/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat
index b3fd4cbf1..c17bec0f7 100644
--- a/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-radius/pretest.dat
@@ -1,11 +1,11 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-alice::cat /etc/raddb/clients.conf
-alice::cat /etc/raddb/eap.conf
-alice::cat /etc/raddb/proxy.conf
-alice::cat /etc/raddb/triplets.dat
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+alice::cat /etc/freeradius/clients.conf
+alice::cat /etc/freeradius/eap.conf
+alice::cat /etc/freeradius/proxy.conf
+alice::cat /etc/freeradius/triplets.dat
+alice::radiusd
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/test.conf b/testing/tests/ikev2/rw-eap-sim-radius/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-eap-sim-radius/test.conf
+++ b/testing/tests/ikev2/rw-eap-sim-radius/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat
index ade9306cf..ab27b4510 100644
--- a/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-rsa/evaltest.dat
@@ -5,6 +5,6 @@ moon:: ipsec status 2> /dev/null::rw-eap-sim.*ESTABLISHED.*moon.strongswan.org.*
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap-sim.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-rsa/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat b/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat
index 23c7a62b2..ae464b51c 100644
--- a/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-sim-rsa/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::cat /etc/ipsec.d/triplets.dat
carol::cat /etc/ipsec.d/triplets.dat
moon::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-sim-rsa/test.conf b/testing/tests/ikev2/rw-eap-sim-rsa/test.conf
index 2bd21499b..e093d43d8 100644
--- a/testing/tests/ikev2/rw-eap-sim-rsa/test.conf
+++ b/testing/tests/ikev2/rw-eap-sim-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat
index 4db0a30b4..314769b3e 100644
--- a/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-fragments/evaltest.dat
@@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, C
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=strongSwan Project, CN=carol@d.strongswan.org' with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat
index 085b19509..e8156ea70 100644
--- a/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-fragments/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/cacerts/*
moon::rm /etc/ipsec.d/certs/*
moon::rm /etc/ipsec.d/private/*
diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat b/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat
index 35d35dc86..3d680ab78 100644
--- a/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-fragments/pretest.dat
@@ -1,7 +1,7 @@
moon::rm /etc/ipsec.d/cacerts/strongswanCert.pem
carol::rm /etc/ipsec.d/cacerts/strongswanCert.pem
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-tls-fragments/test.conf b/testing/tests/ikev2/rw-eap-tls-fragments/test.conf
index 2bd21499b..e093d43d8 100644
--- a/testing/tests/ikev2/rw-eap-tls-fragments/test.conf
+++ b/testing/tests/ikev2/rw-eap-tls-fragments/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat
index 96417face..a436131bf 100644
--- a/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-only/evaltest.dat
@@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN=
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=Research, CN=carol@strongswan.org' with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-tls-only/posttest.dat b/testing/tests/ikev2/rw-eap-tls-only/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/ikev2/rw-eap-tls-only/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-only/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-tls-only/pretest.dat b/testing/tests/ikev2/rw-eap-tls-only/pretest.dat
index ed5498bfe..388339fb8 100644
--- a/testing/tests/ikev2/rw-eap-tls-only/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-only/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-tls-only/test.conf b/testing/tests/ikev2/rw-eap-tls-only/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/ikev2/rw-eap-tls-only/test.conf
+++ b/testing/tests/ikev2/rw-eap-tls-only/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat
index 21190669e..7584e14dc 100644
--- a/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-radius/evaltest.dat
@@ -4,6 +4,6 @@ carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, CN=
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=Research, CN=carol@strongswan.org' with EAP successful::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/eap.conf
index 92f96ad66..92f96ad66 100644
--- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/eap.conf
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/sites-available/default
index 990184919..18ebf9e9d 100644
--- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -39,4 +39,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/users
index 247b918e3..247b918e3 100644
--- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index 1143a0473..000000000
--- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,120 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-tls-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat b/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat
index 920d6a20d..181949fb5 100644
--- a/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-radius/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
carol::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat b/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat
index 280d62e3c..9adc43d3e 100644
--- a/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-tls-radius/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+alice::radiusd
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-eap-tls-radius/test.conf b/testing/tests/ikev2/rw-eap-tls-radius/test.conf
index e0d77b583..eb1e15dd2 100644
--- a/testing/tests/ikev2/rw-eap-tls-radius/test.conf
+++ b/testing/tests/ikev2/rw-eap-tls-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol moon"
+VIRTHOSTS="alice carol moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat
index 941bb2985..d22dd18db 100644
--- a/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-only/evaltest.dat
@@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@stronswan.org::NO
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-only/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat
index 369596177..589d478e7 100644
--- a/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-only/pretest.dat
@@ -1,10 +1,10 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
-carol::sleep 1
+carol::sleep 2
carol::ipsec up home
dave::ipsec up home
-dave::sleep 1
+dave::sleep 2
diff --git a/testing/tests/ikev2/rw-eap-ttls-only/test.conf b/testing/tests/ikev2/rw-eap-ttls-only/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-eap-ttls-only/test.conf
+++ b/testing/tests/ikev2/rw-eap-ttls-only/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat
index 941bb2985..d22dd18db 100644
--- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/evaltest.dat
@@ -14,6 +14,6 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@stronswan.org::NO
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat
index 369596177..17f1b5f2b 100644
--- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf
+++ b/testing/tests/ikev2/rw-eap-ttls-phase2-piggyback/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat
index ff08ae792..a471a2cfa 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/evaltest.dat
@@ -14,7 +14,7 @@ moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw-eap.*ESTABLISHED.*dave@strongswan.org::NO
carol::ipsec status 2> /dev/null::home.*ESTABLISHED::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED::NO
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/eap.conf
index c91cd40fb..c91cd40fb 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/eap.conf
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/default
index 802fcfd8d..dd0825858 100644
--- a/testing/tests/ikev2/rw-eap-md5-radius/hosts/alice/etc/raddb/sites-available/default
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -41,4 +41,3 @@ pre-proxy {
post-proxy {
eap
}
-
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel
index e088fae14..e088fae14 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/users
index 50ccf3e76..50ccf3e76 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index 1143a0473..000000000
--- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,120 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat
index dbe56013a..670d2e72f 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-alice::/etc/init.d/radiusd stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+alice::killall radiusd
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat b/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat
index cbe1ae229..3e7fc0bb1 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/pretest.dat
@@ -1,7 +1,7 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+alice::radiusd
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-eap-ttls-radius/test.conf b/testing/tests/ikev2/rw-eap-ttls-radius/test.conf
index e6a786a94..20d586309 100644
--- a/testing/tests/ikev2/rw-eap-ttls-radius/test.conf
+++ b/testing/tests/ikev2/rw-eap-ttls-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice carol winnetou dave moon"
+VIRTHOSTS="alice carol winnetou dave moon"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/rw-hash-and-url/evaltest.dat b/testing/tests/ikev2/rw-hash-and-url/evaltest.dat
index c52036028..7a9a70939 100644
--- a/testing/tests/ikev2/rw-hash-and-url/evaltest.dat
+++ b/testing/tests/ikev2/rw-hash-and-url/evaltest.dat
@@ -10,8 +10,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-hash-and-url/posttest.dat b/testing/tests/ikev2/rw-hash-and-url/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-hash-and-url/posttest.dat
+++ b/testing/tests/ikev2/rw-hash-and-url/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-hash-and-url/pretest.dat b/testing/tests/ikev2/rw-hash-and-url/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev2/rw-hash-and-url/pretest.dat
+++ b/testing/tests/ikev2/rw-hash-and-url/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-hash-and-url/test.conf b/testing/tests/ikev2/rw-hash-and-url/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-hash-and-url/test.conf
+++ b/testing/tests/ikev2/rw-hash-and-url/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-mark-in-out/description.txt b/testing/tests/ikev2/rw-mark-in-out/description.txt
index 4c35081b1..3012fc656 100644
--- a/testing/tests/ikev2/rw-mark-in-out/description.txt
+++ b/testing/tests/ikev2/rw-mark-in-out/description.txt
@@ -1,7 +1,7 @@
The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the router <b>moon</b> set up
tunnels to gateway <b>sun</b>. Since both roadwarriors possess the same 10.1.0.0/25 subnet,
-gateway <b>sun</b> uses Source NAT after ESP decryption to map these subnets to 10.3.0.10
-and 10.3.0.20, respectively.
+gateway <b>sun</b> uses Source NAT after ESP decryption to map these subnets to PH_IP_CAROL10
+and PH_IP_DAVE10, respectively.
<p/>
In order to differentiate between the tunnels to <b>alice</b> and <b>venus</b>, respectively,
<b>XFRM marks</b> are defined for both the inbound and outbound IPsec SAs and policies using
diff --git a/testing/tests/ikev2/rw-mark-in-out/evaltest.dat b/testing/tests/ikev2/rw-mark-in-out/evaltest.dat
index 4a93dc921..26b26204c 100644
--- a/testing/tests/ikev2/rw-mark-in-out/evaltest.dat
+++ b/testing/tests/ikev2/rw-mark-in-out/evaltest.dat
@@ -3,9 +3,9 @@ venus::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*sun.strongswan.org.*alice@strongswan.org::YES
sun:: ipsec status 2> /dev/null::venus.*ESTABLISHED.*sun.strongswan.org.*venus.strongswan.org::YES
sun:: ipsec statusall 2> /dev/null::alice.*10.2.0.0/16 === 10.1.0.0/25::YES
-sun:: ipsec statusall 2>::venus.*10.2.0.0/16 === 10.1.0.0/25::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+sun:: ipsec statusall 2> /dev/null::venus.*10.2.0.0/16 === 10.1.0.0/25::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
moon::tcpdump::IP alice.strongswan.org > sun.strongswan.org: ESP::YES
moon::tcpdump::IP venus.strongswan.org > sun.strongswan.org: ESP::YES
moon::tcpdump::IP sun.strongswan.org > alice.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables b/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index 5594bbf52..000000000
--- a/testing/tests/ikev2/rw-mark-in-out/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MOBIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown b/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown
index 0d22e684d..421335ffb 100755
--- a/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown
+++ b/testing/tests/ikev2/rw-mark-in-out/hosts/sun/etc/mark_updown
@@ -73,8 +73,12 @@
# just the host, this will be 255.255.255.255.
#
# PLUTO_MY_SOURCEIP
-# if non-empty, then the source address for the route will be
-# set to this IP address.
+# PLUTO_MY_SOURCEIP4_$i
+# PLUTO_MY_SOURCEIP6_$i
+# contains IPv4/IPv6 virtual IP received from a responder,
+# $i enumerates from 1 to the number of IP per address family.
+# PLUTO_MY_SOURCEIP is a legacy variable and equals to the first
+# virtual IP, IPv4 or IPv6.
#
# PLUTO_MY_PROTOCOL
# is the IP protocol that will be transported.
@@ -128,9 +132,15 @@
# contains the remote UDP port in the case of ESP_IN_UDP
# encapsulation
#
+# PLUTO_DNS4_$i
+# PLUTO_DNS6_$i
+# contains IPv4/IPv6 DNS server attribute received from a
+# responder, $i enumerates from 1 to the number of servers per
+# address family.
+#
# define a minimum PATH environment in case it is not set
-PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin"
+PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/sbin"
export PATH
# uncomment to log VPN connections
diff --git a/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables b/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables
deleted file mode 100755
index 5594bbf52..000000000
--- a/testing/tests/ikev2/rw-mark-in-out/hosts/venus/etc/init.d/iptables
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MOBIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-mark-in-out/posttest.dat b/testing/tests/ikev2/rw-mark-in-out/posttest.dat
index fae79271b..283099acb 100644
--- a/testing/tests/ikev2/rw-mark-in-out/posttest.dat
+++ b/testing/tests/ikev2/rw-mark-in-out/posttest.dat
@@ -2,9 +2,9 @@ sun::iptables -t mangle -v -n -L PREROUTING
sun::ipsec stop
alice::ipsec stop
venus::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+venus::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
sun::ip route del 10.1.0.0/16 via PH_IP_MOON
sun::conntrack -F
sun::rm /etc/mark_updown
diff --git a/testing/tests/ikev2/rw-mark-in-out/pretest.dat b/testing/tests/ikev2/rw-mark-in-out/pretest.dat
index 3d9a5f340..8e9dd2f51 100644
--- a/testing/tests/ikev2/rw-mark-in-out/pretest.dat
+++ b/testing/tests/ikev2/rw-mark-in-out/pretest.dat
@@ -1,13 +1,12 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+venus::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to PH_IP_MOON
sun::ip route add 10.1.0.0/16 via PH_IP_MOON
-sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to 10.3.0.10
-sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to 10.3.0.20
-sun::iptables -t mangle -A PREROUTING -d 10.3.0.10 -j MARK --set-mark 11
-sun::iptables -t mangle -A PREROUTING -d 10.3.0.20 -j MARK --set-mark 21
+sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 10 -j SNAT --to PH_IP_CAROL10
+sun::iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 20 -j SNAT --to PH_IP_DAVE10
+sun::iptables -t mangle -A PREROUTING -d PH_IP_CAROL10 -j MARK --set-mark 11
+sun::iptables -t mangle -A PREROUTING -d PH_IP_DAVE10 -j MARK --set-mark 21
alice::ipsec start
venus::ipsec start
sun::ipsec start
diff --git a/testing/tests/ikev2/rw-mark-in-out/test.conf b/testing/tests/ikev2/rw-mark-in-out/test.conf
index ae3c190b8..105472cbe 100644
--- a/testing/tests/ikev2/rw-mark-in-out/test.conf
+++ b/testing/tests/ikev2/rw-mark-in-out/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon bob"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/ikev2/rw-pkcs8/evaltest.dat b/testing/tests/ikev2/rw-pkcs8/evaltest.dat
index b545c2289..2342d024b 100644
--- a/testing/tests/ikev2/rw-pkcs8/evaltest.dat
+++ b/testing/tests/ikev2/rw-pkcs8/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-pkcs8/posttest.dat b/testing/tests/ikev2/rw-pkcs8/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-pkcs8/posttest.dat
+++ b/testing/tests/ikev2/rw-pkcs8/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-pkcs8/pretest.dat b/testing/tests/ikev2/rw-pkcs8/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev2/rw-pkcs8/pretest.dat
+++ b/testing/tests/ikev2/rw-pkcs8/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-pkcs8/test.conf b/testing/tests/ikev2/rw-pkcs8/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-pkcs8/test.conf
+++ b/testing/tests/ikev2/rw-pkcs8/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat
index 683173c30..2fbcc474f 100644
--- a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat
+++ b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat
@@ -7,8 +7,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat
+++ b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat
index 282b2aec0..64ce593fb 100644
--- a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat
+++ b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev2/rw-psk-fqdn/test.conf b/testing/tests/ikev2/rw-psk-fqdn/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-psk-fqdn/test.conf
+++ b/testing/tests/ikev2/rw-psk-fqdn/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat
index 1ad36fcaf..2bd97b76c 100644
--- a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat
+++ b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat
@@ -1,13 +1,13 @@
-carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.100].*\[192.168.0.1]::YES
-dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*\[192.168.0.200].*\[192.168.0.1]::YES
-moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*\[192.168.0.1].*\[192.168.0.100]::YES
-moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*\[192.168.0.1].*\[192.168.0.200]::YES
+carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_CAROL].*\[PH_IP_MOON]::YES
+dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*\[PH_IP_DAVE].*\[PH_IP_MOON]::YES
+moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*\[PH_IP_MOON].*\[PH_IP_CAROL]::YES
+moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*\[PH_IP_MOON].*\[PH_IP_DAVE]::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets
index 18a074472..57ce85d61 100644
--- a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets
@@ -1,3 +1,3 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
-192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
+PH_IP_CAROL : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets
index e989540e9..111de272b 100644
--- a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets
@@ -1,3 +1,3 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
-192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
+PH_IP_DAVE : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets
index ab3fb129b..6706534eb 100644
--- a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets
@@ -1,5 +1,5 @@
# /etc/ipsec.secrets - strongSwan IPsec secrets file
-192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
+PH_IP_CAROL : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
-192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
+PH_IP_DAVE : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat
+++ b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat
index 282b2aec0..64ce593fb 100644
--- a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat
+++ b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev2/rw-psk-ipv4/test.conf b/testing/tests/ikev2/rw-psk-ipv4/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-psk-ipv4/test.conf
+++ b/testing/tests/ikev2/rw-psk-ipv4/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat
index b545c2289..2342d024b 100644
--- a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat
+++ b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat
+++ b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat
index 282b2aec0..64ce593fb 100644
--- a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat
+++ b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::rm /etc/ipsec.d/cacerts/*
carol::rm /etc/ipsec.d/cacerts/*
dave::rm /etc/ipsec.d/cacerts/*
diff --git a/testing/tests/ikev2/rw-psk-no-idr/test.conf b/testing/tests/ikev2/rw-psk-no-idr/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-psk-no-idr/test.conf
+++ b/testing/tests/ikev2/rw-psk-no-idr/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat
index 51e868760..ab398a3bb 100644
--- a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat
@@ -1,13 +1,13 @@
moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES
moon:: cat /var/log/daemon.log::authentication of 'PH_IP_MOON' (myself) with pre-shared key::YES
moon:: ipsec status 2> /dev/null::rw-psk.*INSTALLED, TUNNEL::YES
-carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*\[192.168.0.1]::YES
+carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*\[PH_IP_MOON]::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES
moon:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' (myself) with RSA signature successful::YES
moon:: ipsec status 2> /dev/null::rw-rsasig.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat
index e48d11e42..446f81426 100644
--- a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
carol::ipsec start
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat
index 9a1ab3f8f..1648c9557 100644
--- a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat
+++ b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat
@@ -9,8 +9,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat
+++ b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat
+++ b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/test.conf b/testing/tests/ikev2/rw-psk-rsa-split/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/rw-psk-rsa-split/test.conf
+++ b/testing/tests/ikev2/rw-psk-rsa-split/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-radius-accounting/evaltest.dat b/testing/tests/ikev2/rw-radius-accounting/evaltest.dat
index 5c453f8b4..ccbc769e2 100644
--- a/testing/tests/ikev2/rw-radius-accounting/evaltest.dat
+++ b/testing/tests/ikev2/rw-radius-accounting/evaltest.dat
@@ -9,6 +9,6 @@ carol::ping -c 5 -s 1392 PH_IP_ALICE::1400 bytes from PH_IP_ALICE::YES
carol::ipsec down home 2> /dev/null::no output expected::NO
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
-alice::cat /var/log/radius/radacct/10.1.0.1/*::User-Name =.*carol::YES
-alice::cat /var/log/radius/radacct/10.1.0.1/*::Acct-Output-Octets = 7100::YES
-alice::cat /var/log/radius/radacct/10.1.0.1/*::Acct-Input-Octets = 7100::YES
+alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::User-Name =.*carol::YES
+alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::Acct-Output-Octets = 7100::YES
+alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*::Acct-Input-Octets = 7100::YES
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf
new file mode 100644
index 000000000..623f42904
--- /dev/null
+++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/eap.conf
@@ -0,0 +1,5 @@
+eap {
+ default_eap_type = md5
+ md5 {
+ }
+}
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf
new file mode 100644
index 000000000..783587b55
--- /dev/null
+++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/proxy.conf
@@ -0,0 +1,5 @@
+realm LOCAL {
+ type = radius
+ authhost = LOCAL
+ accthost = LOCAL
+}
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default
new file mode 100644
index 000000000..a67a5dcb4
--- /dev/null
+++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/sites-available/default
@@ -0,0 +1,42 @@
+authorize {
+ eap {
+ ok = return
+ }
+ files
+}
+
+authenticate {
+ eap
+}
+
+preacct {
+ preprocess
+ acct_unique
+ suffix
+ files
+}
+
+accounting {
+ detail
+ unix
+ radutmp
+ attr_filter.accounting_response
+}
+
+session {
+ radutmp
+}
+
+post-auth {
+ exec
+ Post-Auth-Type REJECT {
+ attr_filter.access_reject
+ }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+ eap
+}
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/users b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/users
index 247b918e3..247b918e3 100644
--- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/users
+++ b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index 1143a0473..000000000
--- a/testing/tests/ikev2/rw-radius-accounting/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,120 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 962a418d9..000000000
--- a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow RADIUS accounting protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1813 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1813 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..b9560a38e
--- /dev/null
+++ b/testing/tests/ikev2/rw-radius-accounting/hosts/moon/etc/iptables.rules
@@ -0,0 +1,36 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+# allow RADIUS accounting protocol with alice
+-A INPUT -i eth1 -p udp --sport 1813 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1813 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/rw-radius-accounting/posttest.dat b/testing/tests/ikev2/rw-radius-accounting/posttest.dat
index b1f971402..98f7a6954 100644
--- a/testing/tests/ikev2/rw-radius-accounting/posttest.dat
+++ b/testing/tests/ikev2/rw-radius-accounting/posttest.dat
@@ -1,7 +1,6 @@
carol::ipsec stop
moon::ipsec stop
-alice::/etc/init.d/radiusd stop
-alice::cat /var/log/radius/radacct/10.1.0.1/*
-carol::/etc/init.d/iptables stop 2> /dev/null
-moon::/etc/init.d/iptables stop 2> /dev/null
-
+alice::killall radiusd
+alice::cat /var/log/freeradius/radacct/PH_IP_MOON1/*
+carol::iptables-restore < /etc/iptables.flush
+moon::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-radius-accounting/pretest.dat b/testing/tests/ikev2/rw-radius-accounting/pretest.dat
index 30c8bd573..9f437fe85 100644
--- a/testing/tests/ikev2/rw-radius-accounting/pretest.dat
+++ b/testing/tests/ikev2/rw-radius-accounting/pretest.dat
@@ -1,7 +1,7 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-alice::rm /var/log/radius/radacct/10.1.0.1/*
-alice::/etc/init.d/radiusd start
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+alice::rm /var/log/freeradius/radacct/PH_IP_MOON1/*
+alice::radiusd
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/rw-radius-accounting/test.conf b/testing/tests/ikev2/rw-radius-accounting/test.conf
index f2d20e984..6dbb1c7fd 100644
--- a/testing/tests/ikev2/rw-radius-accounting/test.conf
+++ b/testing/tests/ikev2/rw-radius-accounting/test.conf
@@ -1,25 +1,25 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/ikev2/rw-whitelist/evaltest.dat b/testing/tests/ikev2/rw-whitelist/evaltest.dat
index d6f71d7c0..9418d6ee1 100644
--- a/testing/tests/ikev2/rw-whitelist/evaltest.dat
+++ b/testing/tests/ikev2/rw-whitelist/evaltest.dat
@@ -3,10 +3,10 @@ moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with RS
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES
moon:: cat /var/log/daemon.log::peer identity 'dave@strongswan.org' not whitelisted::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log:: received AUTHENTICATION_FAILED notify error::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED::NO
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::NO
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-whitelist/posttest.dat b/testing/tests/ikev2/rw-whitelist/posttest.dat
index 1777f439f..b757d8b15 100644
--- a/testing/tests/ikev2/rw-whitelist/posttest.dat
+++ b/testing/tests/ikev2/rw-whitelist/posttest.dat
@@ -1,6 +1,6 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/rw-whitelist/pretest.dat b/testing/tests/ikev2/rw-whitelist/pretest.dat
index c4ac77d77..87760775a 100644
--- a/testing/tests/ikev2/rw-whitelist/pretest.dat
+++ b/testing/tests/ikev2/rw-whitelist/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/rw-whitelist/test.conf b/testing/tests/ikev2/rw-whitelist/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/rw-whitelist/test.conf
+++ b/testing/tests/ikev2/rw-whitelist/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/shunt-policies/evaltest.dat b/testing/tests/ikev2/shunt-policies/evaltest.dat
index f40437e3e..a6e40a817 100644
--- a/testing/tests/ikev2/shunt-policies/evaltest.dat
+++ b/testing/tests/ikev2/shunt-policies/evaltest.dat
@@ -1,15 +1,15 @@
moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO
-venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO
+venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
venus::ssh PH_IP_BOB hostname::bob::YES
diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 2b90a14c7..000000000
--- a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow icmp in local net
- iptables -A INPUT -i eth1 -p icmp -j ACCEPT
- iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf
index 90a5d61b1..46ca4cdc3 100644
--- a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/ipsec.conf
@@ -18,7 +18,7 @@ conn local-net
auto=route
conn venus-icmp
- leftsubnet=10.1.0.20/32
+ leftsubnet=PH_IP_VENUS/32
rightsubnet=0.0.0.0/0
leftprotoport=icmp
rightprotoport=icmp
diff --git a/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..af0f25209
--- /dev/null
+++ b/testing/tests/ikev2/shunt-policies/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow icmp in local net
+-A INPUT -i eth1 -p icmp -j ACCEPT
+-A OUTPUT -o eth1 -p icmp -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/ikev2/shunt-policies/posttest.dat b/testing/tests/ikev2/shunt-policies/posttest.dat
index a4c96e10f..837738fc6 100644
--- a/testing/tests/ikev2/shunt-policies/posttest.dat
+++ b/testing/tests/ikev2/shunt-policies/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/shunt-policies/pretest.dat b/testing/tests/ikev2/shunt-policies/pretest.dat
index 2d7a78acb..c724e5df8 100644
--- a/testing/tests/ikev2/shunt-policies/pretest.dat
+++ b/testing/tests/ikev2/shunt-policies/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/ikev2/shunt-policies/test.conf b/testing/tests/ikev2/shunt-policies/test.conf
index cf2ef7424..6b7432ca6 100644
--- a/testing/tests/ikev2/shunt-policies/test.conf
+++ b/testing/tests/ikev2/shunt-policies/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/strong-keys-certs/evaltest.dat b/testing/tests/ikev2/strong-keys-certs/evaltest.dat
index b545c2289..2342d024b 100644
--- a/testing/tests/ikev2/strong-keys-certs/evaltest.dat
+++ b/testing/tests/ikev2/strong-keys-certs/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/strong-keys-certs/posttest.dat b/testing/tests/ikev2/strong-keys-certs/posttest.dat
index 9ccbaa1c2..3fd6a690e 100644
--- a/testing/tests/ikev2/strong-keys-certs/posttest.dat
+++ b/testing/tests/ikev2/strong-keys-certs/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/private/*
carol::rm /etc/ipsec.d/private/*
dave::rm /etc/ipsec.d/private/*
diff --git a/testing/tests/ikev2/strong-keys-certs/pretest.dat b/testing/tests/ikev2/strong-keys-certs/pretest.dat
index de51ccdfa..dea5fc162 100644
--- a/testing/tests/ikev2/strong-keys-certs/pretest.dat
+++ b/testing/tests/ikev2/strong-keys-certs/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/ikev2/strong-keys-certs/test.conf b/testing/tests/ikev2/strong-keys-certs/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/ikev2/strong-keys-certs/test.conf
+++ b/testing/tests/ikev2/strong-keys-certs/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/two-certs/evaltest.dat b/testing/tests/ikev2/two-certs/evaltest.dat
index f50e7c30d..2b4476afa 100644
--- a/testing/tests/ikev2/two-certs/evaltest.dat
+++ b/testing/tests/ikev2/two-certs/evaltest.dat
@@ -1,11 +1,11 @@
moon:: cat /var/log/daemon.log::using certificate.*OU=Research, CN=carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::alice.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::signature validation failed, looking for another key::YES
moon:: cat /var/log/daemon.log::using certificate.*OU=Research, SN=002, CN=carol@strongswan.org::YES
moon:: ipsec status 2> /dev/null::venus.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::venus.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf
index a0f44e312..9ec202e3d 100644
--- a/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev2/two-certs/hosts/carol/etc/ipsec.conf
@@ -18,11 +18,11 @@ conn %default
conn alice
leftcert=carolCert.pem
- rightsubnet=10.1.0.10/32
+ rightsubnet=PH_IP_ALICE/32
auto=add
conn venus
leftcert=carolCert-002.pem
- rightsubnet=10.1.0.20/32
+ rightsubnet=PH_IP_VENUS/32
auto=add
diff --git a/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf
index dac656243..d8f1443ac 100644
--- a/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev2/two-certs/hosts/moon/etc/ipsec.conf
@@ -23,10 +23,10 @@ conn %default
keyexchange=ikev2
conn alice
- leftsubnet=10.1.0.10/32
+ leftsubnet=PH_IP_ALICE/32
auto=add
conn venus
- leftsubnet=10.1.0.20/32
+ leftsubnet=PH_IP_VENUS/32
auto=add
diff --git a/testing/tests/ikev2/two-certs/posttest.dat b/testing/tests/ikev2/two-certs/posttest.dat
index a1f067838..eae8c27d4 100644
--- a/testing/tests/ikev2/two-certs/posttest.dat
+++ b/testing/tests/ikev2/two-certs/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
carol::rm /etc/ipsec.d/private/*
carol::rm /etc/ipsec.d/certs/*
diff --git a/testing/tests/ikev2/two-certs/pretest.dat b/testing/tests/ikev2/two-certs/pretest.dat
index 716cf71e8..fe2aaec19 100644
--- a/testing/tests/ikev2/two-certs/pretest.dat
+++ b/testing/tests/ikev2/two-certs/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/ikev2/two-certs/test.conf b/testing/tests/ikev2/two-certs/test.conf
index d0306cd25..3f6afa02e 100644
--- a/testing/tests/ikev2/two-certs/test.conf
+++ b/testing/tests/ikev2/two-certs/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou"
+VIRTHOSTS="alice venus moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/virtual-ip-override/posttest.dat b/testing/tests/ikev2/virtual-ip-override/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/virtual-ip-override/posttest.dat
+++ b/testing/tests/ikev2/virtual-ip-override/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/virtual-ip-override/pretest.dat b/testing/tests/ikev2/virtual-ip-override/pretest.dat
index 5ec37aae1..1765a83cd 100644
--- a/testing/tests/ikev2/virtual-ip-override/pretest.dat
+++ b/testing/tests/ikev2/virtual-ip-override/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/virtual-ip-override/test.conf b/testing/tests/ikev2/virtual-ip-override/test.conf
index 01c94f7fb..5139506ac 100644
--- a/testing/tests/ikev2/virtual-ip-override/test.conf
+++ b/testing/tests/ikev2/virtual-ip-override/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/virtual-ip/evaltest.dat b/testing/tests/ikev2/virtual-ip/evaltest.dat
index dd3143ae7..0f5df71d7 100644
--- a/testing/tests/ikev2/virtual-ip/evaltest.dat
+++ b/testing/tests/ikev2/virtual-ip/evaltest.dat
@@ -14,12 +14,12 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::src PH_IP_CAROL1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::src PH_IP_DAVE1::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_DAVE1::64 bytes from PH_IP_DAVE1: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/virtual-ip/posttest.dat b/testing/tests/ikev2/virtual-ip/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/ikev2/virtual-ip/posttest.dat
+++ b/testing/tests/ikev2/virtual-ip/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/ikev2/virtual-ip/pretest.dat b/testing/tests/ikev2/virtual-ip/pretest.dat
index 5ec37aae1..1765a83cd 100644
--- a/testing/tests/ikev2/virtual-ip/pretest.dat
+++ b/testing/tests/ikev2/virtual-ip/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/virtual-ip/test.conf b/testing/tests/ikev2/virtual-ip/test.conf
index 1a8f2a4e0..164b07ff9 100644
--- a/testing/tests/ikev2/virtual-ip/test.conf
+++ b/testing/tests/ikev2/virtual-ip/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon alice"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/wildcards/pretest.dat b/testing/tests/ikev2/wildcards/pretest.dat
index e3da87520..3c4832e5e 100644
--- a/testing/tests/ikev2/wildcards/pretest.dat
+++ b/testing/tests/ikev2/wildcards/pretest.dat
@@ -1,4 +1,3 @@
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
carol::ipsec start
dave::ipsec start
moon::ipsec start
diff --git a/testing/tests/ikev2/wildcards/test.conf b/testing/tests/ikev2/wildcards/test.conf
index 08e5cc145..9bb88d79f 100644
--- a/testing/tests/ikev2/wildcards/test.conf
+++ b/testing/tests/ikev2/wildcards/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 47db6db82..000000000
--- a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 47db6db82..000000000
--- a/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/host2host-ikev1/posttest.dat b/testing/tests/ipv6/host2host-ikev1/posttest.dat
index 5a9150bc8..d3bebd0c6 100644
--- a/testing/tests/ipv6/host2host-ikev1/posttest.dat
+++ b/testing/tests/ipv6/host2host-ikev1/posttest.dat
@@ -1,4 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/host2host-ikev1/pretest.dat b/testing/tests/ipv6/host2host-ikev1/pretest.dat
index 7e97e7783..46c015387 100644
--- a/testing/tests/ipv6/host2host-ikev1/pretest.dat
+++ b/testing/tests/ipv6/host2host-ikev1/pretest.dat
@@ -1,7 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection host-host
+sun::expect-connection host-host
moon::ipsec up host-host
-moon::sleep 1
diff --git a/testing/tests/ipv6/host2host-ikev1/test.conf b/testing/tests/ipv6/host2host-ikev1/test.conf
index 6ab5b8a96..56df1a0da 100644
--- a/testing/tests/ipv6/host2host-ikev1/test.conf
+++ b/testing/tests/ipv6/host2host-ikev1/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/host2host-ikev2/posttest.dat b/testing/tests/ipv6/host2host-ikev2/posttest.dat
index 5a9150bc8..d3bebd0c6 100644
--- a/testing/tests/ipv6/host2host-ikev2/posttest.dat
+++ b/testing/tests/ipv6/host2host-ikev2/posttest.dat
@@ -1,4 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/host2host-ikev2/pretest.dat b/testing/tests/ipv6/host2host-ikev2/pretest.dat
index 7e97e7783..46c015387 100644
--- a/testing/tests/ipv6/host2host-ikev2/pretest.dat
+++ b/testing/tests/ipv6/host2host-ikev2/pretest.dat
@@ -1,7 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection host-host
+sun::expect-connection host-host
moon::ipsec up host-host
-moon::sleep 1
diff --git a/testing/tests/ipv6/host2host-ikev2/test.conf b/testing/tests/ipv6/host2host-ikev2/test.conf
index 6ab5b8a96..56df1a0da 100644
--- a/testing/tests/ipv6/host2host-ikev2/test.conf
+++ b/testing/tests/ipv6/host2host-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 47db6db82..000000000
--- a/testing/tests/ipv6/net2net-ikev1/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 47db6db82..000000000
--- a/testing/tests/ipv6/net2net-ikev1/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ikev1/posttest.dat
index 4c95e2afe..078fca541 100644
--- a/testing/tests/ipv6/net2net-ikev1/posttest.dat
+++ b/testing/tests/ipv6/net2net-ikev1/posttest.dat
@@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1"
moon::"ip route del fec2:\:/16 via fec0:\:2"
sun::"ip route del fec1:\:/16 via fec0:\:1"
bob::"ip route del fec1:\:/16 via fec2:\:1"
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/net2net-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ikev1/pretest.dat
index 8a8af2ccb..a14b3cf79 100644
--- a/testing/tests/ipv6/net2net-ikev1/pretest.dat
+++ b/testing/tests/ipv6/net2net-ikev1/pretest.dat
@@ -1,11 +1,13 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec2:\:/16 via fec1:\:1"
moon::"ip route add fec2:\:/16 via fec0:\:2"
sun::"ip route add fec1:\:/16 via fec0:\:1"
bob::"ip route add fec1:\:/16 via fec2:\:1"
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection net-net
+sun::expect-connection net-net
moon::ipsec up net-net
-moon::sleep 1
diff --git a/testing/tests/ipv6/net2net-ikev1/test.conf b/testing/tests/ipv6/net2net-ikev1/test.conf
index 991d884db..55b90befe 100644
--- a/testing/tests/ipv6/net2net-ikev1/test.conf
+++ b/testing/tests/ipv6/net2net-ikev1/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/net2net-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/net2net-ikev2/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ikev2/posttest.dat
index 4c95e2afe..078fca541 100644
--- a/testing/tests/ipv6/net2net-ikev2/posttest.dat
+++ b/testing/tests/ipv6/net2net-ikev2/posttest.dat
@@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1"
moon::"ip route del fec2:\:/16 via fec0:\:2"
sun::"ip route del fec1:\:/16 via fec0:\:1"
bob::"ip route del fec1:\:/16 via fec2:\:1"
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/net2net-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ikev2/pretest.dat
index 8a8af2ccb..a14b3cf79 100644
--- a/testing/tests/ipv6/net2net-ikev2/pretest.dat
+++ b/testing/tests/ipv6/net2net-ikev2/pretest.dat
@@ -1,11 +1,13 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec2:\:/16 via fec1:\:1"
moon::"ip route add fec2:\:/16 via fec0:\:2"
sun::"ip route add fec1:\:/16 via fec0:\:1"
bob::"ip route add fec1:\:/16 via fec2:\:1"
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection net-net
+sun::expect-connection net-net
moon::ipsec up net-net
-moon::sleep 1
diff --git a/testing/tests/ipv6/net2net-ikev2/test.conf b/testing/tests/ipv6/net2net-ikev2/test.conf
index 991d884db..55b90befe 100644
--- a/testing/tests/ipv6/net2net-ikev2/test.conf
+++ b/testing/tests/ipv6/net2net-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat
index 3b3200418..151b73c27 100644
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat
+++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net.net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 47db6db82..000000000
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 47db6db82..000000000
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat
index 5a9150bc8..d3bebd0c6 100644
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat
+++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/posttest.dat
@@ -1,4 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat
index a88456d52..812ccd162 100644
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat
+++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/pretest.dat
@@ -1,7 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection net-net
+sun::expect-connection net-net
moon::ipsec up net-net
-moon::sleep 2
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf
index cab801a1c..8f8d9222d 100644
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf
+++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev1/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b-ip4-in-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat
index 3b3200418..151b73c27 100644
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat
+++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net.net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat
index 5a9150bc8..d3bebd0c6 100644
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat
+++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/posttest.dat
@@ -1,4 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat
index a88456d52..812ccd162 100644
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat
+++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/pretest.dat
@@ -1,7 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection net-net
+sun::expect-connection net-net
moon::ipsec up net-net
-moon::sleep 2
diff --git a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf
index cab801a1c..8f8d9222d 100644
--- a/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf
+++ b/testing/tests/ipv6/net2net-ip4-in-ip6-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b-ip4-in-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index d556762b7..000000000
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 21ff88d0d..000000000
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/hosts/sun/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat
index c78d884ee..078fca541 100644
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/posttest.dat
@@ -1,8 +1,10 @@
moon::ipsec stop
sun::ipsec stop
alice::"ip route del fec2:\:/16 via fec1:\:1"
-moon::"ip route del fec2:\:/16 via fec0:\:2"
-sun::"ip route del fec1:\:/16 via fec0:\:1"
+moon::"ip route del fec2:\:/16 via fec0:\:2"
+sun::"ip route del fec1:\:/16 via fec0:\:1"
bob::"ip route del fec1:\:/16 via fec2:\:1"
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat
index 7781f9b9f..58711bc06 100644
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/pretest.dat
@@ -1,11 +1,13 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec2:\:/16 via fec1:\:1"
-moon::"ip route add fec2:\:/16 via fec0:\:2"
-sun::"ip route add fec1:\:/16 via fec0:\:1"
+moon::"ip route add fec2:\:/16 via fec0:\:2"
+sun::"ip route add fec1:\:/16 via fec0:\:1"
bob::"ip route add fec1:\:/16 via fec2:\:1"
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection net-net
+sun::expect-connection net-net
moon::ipsec up net-net
-moon::sleep 1
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf
index d5d55c749..fe141076d 100644
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev1/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b-ip6-in-ip4.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index d556762b7..000000000
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 21ff88d0d..000000000
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/hosts/sun/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat
index c78d884ee..078fca541 100644
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/posttest.dat
@@ -1,8 +1,10 @@
moon::ipsec stop
sun::ipsec stop
alice::"ip route del fec2:\:/16 via fec1:\:1"
-moon::"ip route del fec2:\:/16 via fec0:\:2"
-sun::"ip route del fec1:\:/16 via fec0:\:1"
+moon::"ip route del fec2:\:/16 via fec0:\:2"
+sun::"ip route del fec1:\:/16 via fec0:\:1"
bob::"ip route del fec1:\:/16 via fec2:\:1"
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat
index 7781f9b9f..58711bc06 100644
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/pretest.dat
@@ -1,11 +1,13 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec2:\:/16 via fec1:\:1"
-moon::"ip route add fec2:\:/16 via fec0:\:2"
-sun::"ip route add fec1:\:/16 via fec0:\:1"
+moon::"ip route add fec2:\:/16 via fec0:\:2"
+sun::"ip route add fec1:\:/16 via fec0:\:1"
bob::"ip route add fec1:\:/16 via fec2:\:1"
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection net-net
+sun::expect-connection net-net
moon::ipsec up net-net
-moon::sleep 1
diff --git a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf
index d5d55c749..fe141076d 100644
--- a/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf
+++ b/testing/tests/ipv6/net2net-ip6-in-ip4-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b-ip6-in-ip4.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/net2net-rfc3779-ikev2/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat b/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat
index 4c95e2afe..078fca541 100644
--- a/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat
+++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/posttest.dat
@@ -4,5 +4,7 @@ alice::"ip route del fec2:\:/16 via fec1:\:1"
moon::"ip route del fec2:\:/16 via fec0:\:2"
sun::"ip route del fec1:\:/16 via fec0:\:1"
bob::"ip route del fec1:\:/16 via fec2:\:1"
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat b/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat
index 8a8af2ccb..a14b3cf79 100644
--- a/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat
+++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/pretest.dat
@@ -1,11 +1,13 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec2:\:/16 via fec1:\:1"
moon::"ip route add fec2:\:/16 via fec0:\:2"
sun::"ip route add fec1:\:/16 via fec0:\:1"
bob::"ip route add fec1:\:/16 via fec2:\:1"
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection net-net
+sun::expect-connection net-net
moon::ipsec up net-net
-moon::sleep 1
diff --git a/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf b/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf
index 991d884db..55b90befe 100644
--- a/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf
+++ b/testing/tests/ipv6/net2net-rfc3779-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/rw-ikev1/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/rw-ikev1/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 47db6db82..000000000
--- a/testing/tests/ipv6/rw-ikev1/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ikev1/posttest.dat b/testing/tests/ipv6/rw-ikev1/posttest.dat
index 07e89d7da..4e59395e3 100644
--- a/testing/tests/ipv6/rw-ikev1/posttest.dat
+++ b/testing/tests/ipv6/rw-ikev1/posttest.dat
@@ -1,9 +1,12 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+carol::ip6tables-restore < /etc/ip6tables.flush
+dave::ip6tables-restore < /etc/ip6tables.flush
alice::"ip route del fec0:\:/16 via fec1:\:1"
carol::"ip route del fec1:\:/16 via fec0:\:1"
dave::"ip route del fec1:\:/16 via fec0:\:1"
diff --git a/testing/tests/ipv6/rw-ikev1/pretest.dat b/testing/tests/ipv6/rw-ikev1/pretest.dat
index 7da0c1028..f60be3887 100644
--- a/testing/tests/ipv6/rw-ikev1/pretest.dat
+++ b/testing/tests/ipv6/rw-ikev1/pretest.dat
@@ -1,13 +1,17 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+carol::iptables-restore < /etc/iptables.drop
+dave::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+carol::ip6tables-restore < /etc/ip6tables.rules
+dave::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec0:\:/16 via fec1:\:1"
carol::"ip route add fec1:\:/16 via fec0:\:1"
dave::"ip route add fec1:\:/16 via fec0:\:1"
moon::ipsec start
carol::ipsec start
dave::ipsec start
-carol::sleep 1
+moon::expect-connection rw
+carol::expect-connection home
+dave::expect-connection home
carol::ipsec up home
dave::ipsec up home
-dave::sleep 2
diff --git a/testing/tests/ipv6/rw-ikev1/test.conf b/testing/tests/ipv6/rw-ikev1/test.conf
index 80cf5e3a1..05bb8ab6d 100644
--- a/testing/tests/ipv6/rw-ikev1/test.conf
+++ b/testing/tests/ipv6/rw-ikev1/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/rw-ikev2/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/rw-ikev2/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/rw-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ikev2/posttest.dat b/testing/tests/ipv6/rw-ikev2/posttest.dat
index 07e89d7da..4e59395e3 100644
--- a/testing/tests/ipv6/rw-ikev2/posttest.dat
+++ b/testing/tests/ipv6/rw-ikev2/posttest.dat
@@ -1,9 +1,12 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+carol::ip6tables-restore < /etc/ip6tables.flush
+dave::ip6tables-restore < /etc/ip6tables.flush
alice::"ip route del fec0:\:/16 via fec1:\:1"
carol::"ip route del fec1:\:/16 via fec0:\:1"
dave::"ip route del fec1:\:/16 via fec0:\:1"
diff --git a/testing/tests/ipv6/rw-ikev2/pretest.dat b/testing/tests/ipv6/rw-ikev2/pretest.dat
index 7da0c1028..f60be3887 100644
--- a/testing/tests/ipv6/rw-ikev2/pretest.dat
+++ b/testing/tests/ipv6/rw-ikev2/pretest.dat
@@ -1,13 +1,17 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+carol::iptables-restore < /etc/iptables.drop
+dave::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+carol::ip6tables-restore < /etc/ip6tables.rules
+dave::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec0:\:/16 via fec1:\:1"
carol::"ip route add fec1:\:/16 via fec0:\:1"
dave::"ip route add fec1:\:/16 via fec0:\:1"
moon::ipsec start
carol::ipsec start
dave::ipsec start
-carol::sleep 1
+moon::expect-connection rw
+carol::expect-connection home
+dave::expect-connection home
carol::ipsec up home
dave::ipsec up home
-dave::sleep 2
diff --git a/testing/tests/ipv6/rw-ikev2/test.conf b/testing/tests/ipv6/rw-ikev2/test.conf
index 80cf5e3a1..05bb8ab6d 100644
--- a/testing/tests/ipv6/rw-ikev2/test.conf
+++ b/testing/tests/ipv6/rw-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 7f904a693..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/carol/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index 7f904a693..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/dave/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index f5bd956ad..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/hosts/moon/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat
index 179b8fe58..ebe5e2a80 100644
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/posttest.dat
@@ -1,7 +1,10 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+carol::ip6tables-restore < /etc/ip6tables.flush
+dave::ip6tables-restore < /etc/ip6tables.flush
alice::"ip route del fec3:\:/16 via fec1:\:1"
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat
index ca544e373..e73bde487 100644
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/pretest.dat
@@ -1,11 +1,15 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+moon::ip6tables-restore < /etc/ip6tables.rules
+carol::ip6tables-restore < /etc/ip6tables.rules
+dave::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec3:\:/16 via fec1:\:1"
moon::ipsec start
carol::ipsec start
dave::ipsec start
-carol::sleep 1
+moon::expect-connection rw
+carol::expect-connection home
+dave::expect-connection home
carol::ipsec up home
dave::ipsec up home
-dave::sleep 2
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt
deleted file mode 100644
index 9609ae268..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/description.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-The roadwarriors <b>carol</b> and <b>dave</b> set up an IPv6-in-IPv4 tunnel connection each
-to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
-Both <b>carol</b> and <b>dave</b> request a virtual IPv6 address from <b>moon</b> via
-the IKEvi1 mode config payload.
-<p/>
-Upon the successful establishment of the ESP tunnels, <b>leftfirewall=yes</b>
-automatically inserts ip6tables-based firewall rules that let pass the tunneled traffic.
-In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> send
-an IPv6 ICMP request to the client <b>alice</b> behind the gateway <b>moon</b>
-using the ping6 command.
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat
deleted file mode 100644
index f6dc9aa3e..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/evaltest.dat
+++ /dev/null
@@ -1,15 +0,0 @@
-carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
-dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
-moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
-moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
-carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
-moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES
-dave:: ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES
-moon::tcpdump::carol.strongswan.org > moon.strongswan.org: ESP::YES
-moon::tcpdump::moon.strongswan.org > carol.strongswan.org: ESP::YES
-moon::tcpdump::dave.strongswan.org > moon.strongswan.org: ESP::YES
-moon::tcpdump::moon.strongswan.org > dave.strongswan.org: ESP::YES
-
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat
deleted file mode 100644
index 179b8fe58..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/posttest.dat
+++ /dev/null
@@ -1,7 +0,0 @@
-moon::ipsec stop
-carol::ipsec stop
-dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
-alice::"ip route del fec3:\:/16 via fec1:\:1"
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat
deleted file mode 100644
index ca544e373..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/pretest.dat
+++ /dev/null
@@ -1,11 +0,0 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-alice::"ip route add fec3:\:/16 via fec1:\:1"
-moon::ipsec start
-carol::ipsec start
-dave::ipsec start
-carol::sleep 1
-carol::ipsec up home
-dave::ipsec up home
-dave::sleep 2
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf
deleted file mode 100644
index 80cf5e3a1..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/rw-ip6-in-ip4-ikev1/test.conf
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/bash
-#
-# This configuration file provides information on the
-# UML instances used for this test
-
-# All UML instances that are required for this test
-#
-UMLHOSTS="alice moon carol winnetou dave"
-
-# Corresponding block diagram
-#
-DIAGRAM="a-m-c-w-d-ip6.png"
-
-# UML instances on which tcpdump is to be started
-#
-TCPDUMPHOSTS="moon"
-
-# UML instances on which IPsec is started
-# Used for IPsec logging purposes
-#
-IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf
index 80cf5e3a1..05bb8ab6d 100644
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev1/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 7f904a693..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/carol/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index 7f904a693..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/dave/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index f5bd956ad..000000000
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow ESP
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules
new file mode 100644
index 000000000..409f2e9bb
--- /dev/null
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/hosts/moon/etc/ip6tables.rules
@@ -0,0 +1,20 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ICMPv6 neighbor-solicitations
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
+
+# allow ICMPv6 neighbor-advertisements
+-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
+
+# log dropped packets
+-A INPUT -j LOG --log-prefix " IN: "
+-A OUTPUT -j LOG --log-prefix " OUT: "
+
+COMMIT
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat
index 179b8fe58..ebe5e2a80 100644
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/posttest.dat
@@ -1,7 +1,10 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+carol::ip6tables-restore < /etc/ip6tables.flush
+dave::ip6tables-restore < /etc/ip6tables.flush
alice::"ip route del fec3:\:/16 via fec1:\:1"
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat
index ca544e373..e73bde487 100644
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/pretest.dat
@@ -1,11 +1,15 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+moon::ip6tables-restore < /etc/ip6tables.rules
+carol::ip6tables-restore < /etc/ip6tables.rules
+dave::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec3:\:/16 via fec1:\:1"
moon::ipsec start
carol::ipsec start
dave::ipsec start
-carol::sleep 1
+moon::expect-connection rw
+carol::expect-connection home
+dave::expect-connection home
carol::ipsec up home
dave::ipsec up home
-dave::sleep 2
diff --git a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf
index 80cf5e3a1..05bb8ab6d 100644
--- a/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf
+++ b/testing/tests/ipv6/rw-ip6-in-ip4-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 6c437fe03..000000000
--- a/testing/tests/ipv6/rw-psk-ikev1/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index 6c437fe03..000000000
--- a/testing/tests/ipv6/rw-psk-ikev1/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 6c437fe03..000000000
--- a/testing/tests/ipv6/rw-psk-ikev1/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-psk-ikev1/posttest.dat b/testing/tests/ipv6/rw-psk-ikev1/posttest.dat
index 07e89d7da..4e59395e3 100644
--- a/testing/tests/ipv6/rw-psk-ikev1/posttest.dat
+++ b/testing/tests/ipv6/rw-psk-ikev1/posttest.dat
@@ -1,9 +1,12 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+carol::ip6tables-restore < /etc/ip6tables.flush
+dave::ip6tables-restore < /etc/ip6tables.flush
alice::"ip route del fec0:\:/16 via fec1:\:1"
carol::"ip route del fec1:\:/16 via fec0:\:1"
dave::"ip route del fec1:\:/16 via fec0:\:1"
diff --git a/testing/tests/ipv6/rw-psk-ikev1/pretest.dat b/testing/tests/ipv6/rw-psk-ikev1/pretest.dat
index e3040d125..93a96ec36 100644
--- a/testing/tests/ipv6/rw-psk-ikev1/pretest.dat
+++ b/testing/tests/ipv6/rw-psk-ikev1/pretest.dat
@@ -1,6 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+carol::iptables-restore < /etc/iptables.drop
+dave::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+carol::ip6tables-restore < /etc/ip6tables.rules
+dave::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec0:\:/16 via fec1:\:1"
carol::"ip route add fec1:\:/16 via fec0:\:1"
dave::"ip route add fec1:\:/16 via fec0:\:1"
@@ -10,7 +13,8 @@ dave::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
carol::ipsec start
dave::ipsec start
-carol::sleep 1
+moon::expect-connection rw
+carol::expect-connection home
+dave::expect-connection home
carol::ipsec up home
dave::ipsec up home
-dave::sleep 1
diff --git a/testing/tests/ipv6/rw-psk-ikev1/test.conf b/testing/tests/ipv6/rw-psk-ikev1/test.conf
index 80cf5e3a1..05bb8ab6d 100644
--- a/testing/tests/ipv6/rw-psk-ikev1/test.conf
+++ b/testing/tests/ipv6/rw-psk-ikev1/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 6c437fe03..000000000
--- a/testing/tests/ipv6/rw-psk-ikev2/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index 6c437fe03..000000000
--- a/testing/tests/ipv6/rw-psk-ikev2/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 6c437fe03..000000000
--- a/testing/tests/ipv6/rw-psk-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-psk-ikev2/posttest.dat b/testing/tests/ipv6/rw-psk-ikev2/posttest.dat
index 07e89d7da..4e59395e3 100644
--- a/testing/tests/ipv6/rw-psk-ikev2/posttest.dat
+++ b/testing/tests/ipv6/rw-psk-ikev2/posttest.dat
@@ -1,9 +1,12 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+carol::ip6tables-restore < /etc/ip6tables.flush
+dave::ip6tables-restore < /etc/ip6tables.flush
alice::"ip route del fec0:\:/16 via fec1:\:1"
carol::"ip route del fec1:\:/16 via fec0:\:1"
dave::"ip route del fec1:\:/16 via fec0:\:1"
diff --git a/testing/tests/ipv6/rw-psk-ikev2/pretest.dat b/testing/tests/ipv6/rw-psk-ikev2/pretest.dat
index e3040d125..93a96ec36 100644
--- a/testing/tests/ipv6/rw-psk-ikev2/pretest.dat
+++ b/testing/tests/ipv6/rw-psk-ikev2/pretest.dat
@@ -1,6 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+carol::iptables-restore < /etc/iptables.drop
+dave::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+carol::ip6tables-restore < /etc/ip6tables.rules
+dave::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec0:\:/16 via fec1:\:1"
carol::"ip route add fec1:\:/16 via fec0:\:1"
dave::"ip route add fec1:\:/16 via fec0:\:1"
@@ -10,7 +13,8 @@ dave::rm /etc/ipsec.d/cacerts/*
moon::ipsec start
carol::ipsec start
dave::ipsec start
-carol::sleep 1
+moon::expect-connection rw
+carol::expect-connection home
+dave::expect-connection home
carol::ipsec up home
dave::ipsec up home
-dave::sleep 1
diff --git a/testing/tests/ipv6/rw-psk-ikev2/test.conf b/testing/tests/ipv6/rw-psk-ikev2/test.conf
index 80cf5e3a1..05bb8ab6d 100644
--- a/testing/tests/ipv6/rw-psk-ikev2/test.conf
+++ b/testing/tests/ipv6/rw-psk-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/rw-rfc3779-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat b/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat
index 07e89d7da..4e59395e3 100644
--- a/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat
+++ b/testing/tests/ipv6/rw-rfc3779-ikev2/posttest.dat
@@ -1,9 +1,12 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+carol::ip6tables-restore < /etc/ip6tables.flush
+dave::ip6tables-restore < /etc/ip6tables.flush
alice::"ip route del fec0:\:/16 via fec1:\:1"
carol::"ip route del fec1:\:/16 via fec0:\:1"
dave::"ip route del fec1:\:/16 via fec0:\:1"
diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat b/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat
index 7da0c1028..f60be3887 100644
--- a/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat
+++ b/testing/tests/ipv6/rw-rfc3779-ikev2/pretest.dat
@@ -1,13 +1,17 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+carol::iptables-restore < /etc/iptables.drop
+dave::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+carol::ip6tables-restore < /etc/ip6tables.rules
+dave::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec0:\:/16 via fec1:\:1"
carol::"ip route add fec1:\:/16 via fec0:\:1"
dave::"ip route add fec1:\:/16 via fec0:\:1"
moon::ipsec start
carol::ipsec start
dave::ipsec start
-carol::sleep 1
+moon::expect-connection rw
+carol::expect-connection home
+dave::expect-connection home
carol::ipsec up home
dave::ipsec up home
-dave::sleep 2
diff --git a/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf b/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf
index 80cf5e3a1..05bb8ab6d 100644
--- a/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf
+++ b/testing/tests/ipv6/rw-rfc3779-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 343fd49ed..000000000
--- a/testing/tests/ipv6/transport-ikev1/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certficate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index 47db6db82..000000000
--- a/testing/tests/ipv6/transport-ikev1/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow last IPv6 UDP fragments
- ip6tables -A INPUT -p udp -m frag --fraglast -j ACCEPT
- ip6tables -A OUTPUT -p udp -m frag --fraglast -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/transport-ikev1/posttest.dat b/testing/tests/ipv6/transport-ikev1/posttest.dat
index 5a9150bc8..d3bebd0c6 100644
--- a/testing/tests/ipv6/transport-ikev1/posttest.dat
+++ b/testing/tests/ipv6/transport-ikev1/posttest.dat
@@ -1,4 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/transport-ikev1/pretest.dat b/testing/tests/ipv6/transport-ikev1/pretest.dat
index 7e97e7783..46c015387 100644
--- a/testing/tests/ipv6/transport-ikev1/pretest.dat
+++ b/testing/tests/ipv6/transport-ikev1/pretest.dat
@@ -1,7 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection host-host
+sun::expect-connection host-host
moon::ipsec up host-host
-moon::sleep 1
diff --git a/testing/tests/ipv6/transport-ikev1/test.conf b/testing/tests/ipv6/transport-ikev1/test.conf
index 6ab5b8a96..56df1a0da 100644
--- a/testing/tests/ipv6/transport-ikev1/test.conf
+++ b/testing/tests/ipv6/transport-ikev1/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index b1e7073af..000000000
--- a/testing/tests/ipv6/transport-ikev2/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certficate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables b/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables
deleted file mode 100755
index b3509f8df..000000000
--- a/testing/tests/ipv6/transport-ikev2/hosts/sun/etc/init.d/iptables
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl and certificate fetch from winnetou
- ip6tables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP6_WINNETOU -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP6_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/ipv6/transport-ikev2/posttest.dat b/testing/tests/ipv6/transport-ikev2/posttest.dat
index 5a9150bc8..d3bebd0c6 100644
--- a/testing/tests/ipv6/transport-ikev2/posttest.dat
+++ b/testing/tests/ipv6/transport-ikev2/posttest.dat
@@ -1,4 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush
diff --git a/testing/tests/ipv6/transport-ikev2/pretest.dat b/testing/tests/ipv6/transport-ikev2/pretest.dat
index 7e97e7783..46c015387 100644
--- a/testing/tests/ipv6/transport-ikev2/pretest.dat
+++ b/testing/tests/ipv6/transport-ikev2/pretest.dat
@@ -1,7 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
moon::ipsec start
sun::ipsec start
-moon::sleep 2
+moon::expect-connection host-host
+sun::expect-connection host-host
moon::ipsec up host-host
-moon::sleep 1
diff --git a/testing/tests/ipv6/transport-ikev2/test.conf b/testing/tests/ipv6/transport-ikev2/test.conf
index 6ab5b8a96..56df1a0da 100644
--- a/testing/tests/ipv6/transport-ikev2/test.conf
+++ b/testing/tests/ipv6/transport-ikev2/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat b/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat
index 5b5c94fb1..4d614bf7e 100644
--- a/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat
+++ b/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat
@@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
moon:: ip xfrm state::enc cbc(camellia)::YES
diff --git a/testing/tests/openssl-ikev1/alg-camellia/posttest.dat b/testing/tests/openssl-ikev1/alg-camellia/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/openssl-ikev1/alg-camellia/posttest.dat
+++ b/testing/tests/openssl-ikev1/alg-camellia/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev1/alg-camellia/pretest.dat b/testing/tests/openssl-ikev1/alg-camellia/pretest.dat
index ed5498bfe..388339fb8 100644
--- a/testing/tests/openssl-ikev1/alg-camellia/pretest.dat
+++ b/testing/tests/openssl-ikev1/alg-camellia/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/openssl-ikev1/alg-camellia/test.conf b/testing/tests/openssl-ikev1/alg-camellia/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/openssl-ikev1/alg-camellia/test.conf
+++ b/testing/tests/openssl-ikev1/alg-camellia/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat
index 2ba48e5ce..ac7d8cd98 100644
--- a/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat
+++ b/testing/tests/openssl-ikev1/alg-ecp-high/evaltest.dat
@@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384::YES
dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat
+++ b/testing/tests/openssl-ikev1/alg-ecp-high/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat b/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat
+++ b/testing/tests/openssl-ikev1/alg-ecp-high/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev1/alg-ecp-high/test.conf b/testing/tests/openssl-ikev1/alg-ecp-high/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev1/alg-ecp-high/test.conf
+++ b/testing/tests/openssl-ikev1/alg-ecp-high/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat
index 6cf2438d4..178d541da 100644
--- a/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat
+++ b/testing/tests/openssl-ikev1/alg-ecp-low/evaltest.dat
@@ -8,8 +8,8 @@ moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_224::YES
dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat
+++ b/testing/tests/openssl-ikev1/alg-ecp-low/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat b/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat
+++ b/testing/tests/openssl-ikev1/alg-ecp-low/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev1/alg-ecp-low/test.conf b/testing/tests/openssl-ikev1/alg-ecp-low/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev1/alg-ecp-low/test.conf
+++ b/testing/tests/openssl-ikev1/alg-ecp-low/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat
index 244ea0331..69c893f0c 100644
--- a/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat
+++ b/testing/tests/openssl-ikev1/ecdsa-certs/evaltest.dat
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC
moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA successful::YES
carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA successful::YES
dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA successful::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat
+++ b/testing/tests/openssl-ikev1/ecdsa-certs/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat b/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat
+++ b/testing/tests/openssl-ikev1/ecdsa-certs/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev1/ecdsa-certs/test.conf b/testing/tests/openssl-ikev1/ecdsa-certs/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev1/ecdsa-certs/test.conf
+++ b/testing/tests/openssl-ikev1/ecdsa-certs/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat b/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat
index 3787bdb68..cd83c56b4 100644
--- a/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat
+++ b/testing/tests/openssl-ikev2/alg-blowfish/evaltest.dat
@@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*caro
moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*dave@strongswan.org::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_256/HMAC_SHA2_512_256::YES
dave:: ipsec statusall 2> /dev/null::IKE proposal: BLOWFISH_CBC_128/HMAC_SHA2_256_128::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
carol::ipsec statusall 2> /dev/null::BLOWFISH_CBC_192/HMAC_SHA2_384_192,::YES
dave:: ipsec statusall 2> /dev/null::BLOWFISH_CBC_128/HMAC_SHA2_256_128,::YES
carol::ip -s xfrm state::enc cbc(blowfish).*(192 bits)::YES
diff --git a/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat b/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat
+++ b/testing/tests/openssl-ikev2/alg-blowfish/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat b/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat
+++ b/testing/tests/openssl-ikev2/alg-blowfish/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev2/alg-blowfish/test.conf b/testing/tests/openssl-ikev2/alg-blowfish/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev2/alg-blowfish/test.conf
+++ b/testing/tests/openssl-ikev2/alg-blowfish/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat b/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat
index 5b5c94fb1..4d614bf7e 100644
--- a/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat
+++ b/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat
@@ -2,7 +2,7 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
moon:: ip xfrm state::enc cbc(camellia)::YES
diff --git a/testing/tests/openssl-ikev2/alg-camellia/posttest.dat b/testing/tests/openssl-ikev2/alg-camellia/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/openssl-ikev2/alg-camellia/posttest.dat
+++ b/testing/tests/openssl-ikev2/alg-camellia/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/alg-camellia/pretest.dat b/testing/tests/openssl-ikev2/alg-camellia/pretest.dat
index 3c3df0196..886fdf55c 100644
--- a/testing/tests/openssl-ikev2/alg-camellia/pretest.dat
+++ b/testing/tests/openssl-ikev2/alg-camellia/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/openssl-ikev2/alg-camellia/test.conf b/testing/tests/openssl-ikev2/alg-camellia/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/openssl-ikev2/alg-camellia/test.conf
+++ b/testing/tests/openssl-ikev2/alg-camellia/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat
index 2540eb106..375ed86a1 100644
--- a/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat
+++ b/testing/tests/openssl-ikev2/alg-ecp-high/evaltest.dat
@@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::ECP_256.*ECP_384::YES
dave:: cat /var/log/daemon.log::ECP_256.*ECP_521::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384::YES
dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat
+++ b/testing/tests/openssl-ikev2/alg-ecp-high/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat b/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat
+++ b/testing/tests/openssl-ikev2/alg-ecp-high/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev2/alg-ecp-high/test.conf b/testing/tests/openssl-ikev2/alg-ecp-high/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev2/alg-ecp-high/test.conf
+++ b/testing/tests/openssl-ikev2/alg-ecp-high/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat
index f82159e7c..c46ed1dd2 100644
--- a/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat
+++ b/testing/tests/openssl-ikev2/alg-ecp-low/evaltest.dat
@@ -10,8 +10,8 @@ carol::cat /var/log/daemon.log::ECP_192.*ECP_224::YES
dave:: cat /var/log/daemon.log::ECP_192.*ECP_256::YES
carol::ipsec statusall 2> /dev/null::home.*3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_224::YES
dave:: ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat
+++ b/testing/tests/openssl-ikev2/alg-ecp-low/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat b/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat
+++ b/testing/tests/openssl-ikev2/alg-ecp-low/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev2/alg-ecp-low/test.conf b/testing/tests/openssl-ikev2/alg-ecp-low/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev2/alg-ecp-low/test.conf
+++ b/testing/tests/openssl-ikev2/alg-ecp-low/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev2/critical-extension/posttest.dat b/testing/tests/openssl-ikev2/critical-extension/posttest.dat
index a4c96e10f..837738fc6 100644
--- a/testing/tests/openssl-ikev2/critical-extension/posttest.dat
+++ b/testing/tests/openssl-ikev2/critical-extension/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/critical-extension/pretest.dat b/testing/tests/openssl-ikev2/critical-extension/pretest.dat
index 2d7a78acb..c724e5df8 100644
--- a/testing/tests/openssl-ikev2/critical-extension/pretest.dat
+++ b/testing/tests/openssl-ikev2/critical-extension/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/openssl-ikev2/critical-extension/test.conf b/testing/tests/openssl-ikev2/critical-extension/test.conf
index 41ee3037e..b286ef6eb 100644
--- a/testing/tests/openssl-ikev2/critical-extension/test.conf
+++ b/testing/tests/openssl-ikev2/critical-extension/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS=""
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat
index 5918faa8c..0110bb996 100644
--- a/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat
+++ b/testing/tests/openssl-ikev2/ecdsa-certs/evaltest.dat
@@ -10,8 +10,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC
moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA-384 signature successful::YES
carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES
dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat
+++ b/testing/tests/openssl-ikev2/ecdsa-certs/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat b/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat
+++ b/testing/tests/openssl-ikev2/ecdsa-certs/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev2/ecdsa-certs/test.conf b/testing/tests/openssl-ikev2/ecdsa-certs/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev2/ecdsa-certs/test.conf
+++ b/testing/tests/openssl-ikev2/ecdsa-certs/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat
index 52913759f..8a4215dcc 100644
--- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat
+++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/evaltest.dat
@@ -6,8 +6,8 @@ moon:: cat /var/log/daemon.log::authentication of.*carol@strongswan.org.*with EC
moon:: cat /var/log/daemon.log::authentication of.*dave@strongswan.org.*with ECDSA-384 signature successful::YES
carol::cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES
dave:: cat /var/log/daemon.log::authentication of.*moon.strongswan.org.*with ECDSA-521 signature successful::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat
+++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat b/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat
+++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf b/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf
+++ b/testing/tests/openssl-ikev2/ecdsa-pkcs8/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev2/rw-cert/evaltest.dat b/testing/tests/openssl-ikev2/rw-cert/evaltest.dat
index f8cfb111b..ba661975b 100644
--- a/testing/tests/openssl-ikev2/rw-cert/evaltest.dat
+++ b/testing/tests/openssl-ikev2/rw-cert/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev2/rw-cert/posttest.dat b/testing/tests/openssl-ikev2/rw-cert/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/openssl-ikev2/rw-cert/posttest.dat
+++ b/testing/tests/openssl-ikev2/rw-cert/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/rw-cert/pretest.dat b/testing/tests/openssl-ikev2/rw-cert/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/openssl-ikev2/rw-cert/pretest.dat
+++ b/testing/tests/openssl-ikev2/rw-cert/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/openssl-ikev2/rw-cert/test.conf b/testing/tests/openssl-ikev2/rw-cert/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/openssl-ikev2/rw-cert/test.conf
+++ b/testing/tests/openssl-ikev2/rw-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat
index e476da03f..1ae780e4b 100644
--- a/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat
+++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/evaltest.dat
@@ -5,6 +5,6 @@ carol::cat /var/log/daemon.log::negotiated TLS 1.2 using suite TLS_ECDHE_ECDSA_W
carol::cat /var/log/daemon.log::allow mutual EAP-only authentication::YES
carol::cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=ECDSA 521 bit, CN=moon.strongswan.org' with EAP successful::YES
moon:: cat /var/log/daemon.log::authentication of 'C=CH, O=Linux strongSwan, OU=ECDSA 256 bit, CN=carol@strongswan.org' with EAP successful::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat
+++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat b/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat
index ed5498bfe..388339fb8 100644
--- a/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat
+++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf b/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf
+++ b/testing/tests/openssl-ikev2/rw-eap-tls-only/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/p2pnat/behind-same-nat/evaltest.dat b/testing/tests/p2pnat/behind-same-nat/evaltest.dat
index 8c79a28c1..378520596 100644
--- a/testing/tests/p2pnat/behind-same-nat/evaltest.dat
+++ b/testing/tests/p2pnat/behind-same-nat/evaltest.dat
@@ -7,5 +7,5 @@ alice::ipsec status 2> /dev/null::peer.*ESTABLISHED.*alice@strongswan.org.*venus
venus::ipsec status 2> /dev/null::peer.*ESTABLISHED.*venus.strongswan.org.*alice@strongswan.org::YES
alice::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES
venus::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+venus::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index 1eb88c15c..000000000
--- a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules
new file mode 100644
index 000000000..da385d22a
--- /dev/null
+++ b/testing/tests/p2pnat/behind-same-nat/hosts/alice/etc/iptables.rules
@@ -0,0 +1,28 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 40510ce60..000000000
--- a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE behind NAT
- iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/p2pnat/behind-same-nat/hosts/carol/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables
deleted file mode 100755
index 6fca87b4a..000000000
--- a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/init.d/iptables
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules
new file mode 100644
index 000000000..da385d22a
--- /dev/null
+++ b/testing/tests/p2pnat/behind-same-nat/hosts/venus/etc/iptables.rules
@@ -0,0 +1,28 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/p2pnat/behind-same-nat/posttest.dat b/testing/tests/p2pnat/behind-same-nat/posttest.dat
index 36cd0f36d..a1d5b4612 100644
--- a/testing/tests/p2pnat/behind-same-nat/posttest.dat
+++ b/testing/tests/p2pnat/behind-same-nat/posttest.dat
@@ -1,8 +1,8 @@
venus::ipsec stop
alice::ipsec stop
carol::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+venus::iptables-restore < /etc/iptables.flush
+moon::iptables-restore < /etc/iptables.flush
moon::conntrack -F
diff --git a/testing/tests/p2pnat/behind-same-nat/pretest.dat b/testing/tests/p2pnat/behind-same-nat/pretest.dat
index f1e33dc39..eb1d67fa2 100644
--- a/testing/tests/p2pnat/behind-same-nat/pretest.dat
+++ b/testing/tests/p2pnat/behind-same-nat/pretest.dat
@@ -1,7 +1,7 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+alice::iptables-restore < /etc/iptables.rules
+venus::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+moon::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
@@ -10,5 +10,5 @@ carol::ipsec start
carol::sleep 1
alice::ipsec start
alice::sleep 1
-venus::ipsec start
-venus::sleep 4
+venus::ipsec start
+venus::sleep 4
diff --git a/testing/tests/p2pnat/behind-same-nat/test.conf b/testing/tests/p2pnat/behind-same-nat/test.conf
index f98a0ab1b..fe44ff97b 100644
--- a/testing/tests/p2pnat/behind-same-nat/test.conf
+++ b/testing/tests/p2pnat/behind-same-nat/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou"
+VIRTHOSTS="alice venus moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-med.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus carol"
diff --git a/testing/tests/p2pnat/medsrv-psk/evaltest.dat b/testing/tests/p2pnat/medsrv-psk/evaltest.dat
index 1b89c7ebe..2c6080775 100644
--- a/testing/tests/p2pnat/medsrv-psk/evaltest.dat
+++ b/testing/tests/p2pnat/medsrv-psk/evaltest.dat
@@ -6,7 +6,7 @@ alice::ipsec status 2> /dev/null::peer.*ESTABLISHED.*alice@strongswan.org.*bob@s
bob:: ipsec status 2> /dev/null::peer.*ESTABLISHED.*bob@strongswan.org.*alice@strongswan.org::YES
alice::ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES
bob:: ipsec status 2> /dev/null::peer.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.*: UDP::YES
moon::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables
deleted file mode 100755
index c6371c745..000000000
--- a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/init.d/iptables
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/p2pnat/medsrv-psk/hosts/alice/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/p2pnat/medsrv-psk/hosts/bob/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 40510ce60..000000000
--- a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE behind NAT
- iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
-
- # allow NAT-T
- iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/p2pnat/medsrv-psk/hosts/carol/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/p2pnat/medsrv-psk/posttest.dat b/testing/tests/p2pnat/medsrv-psk/posttest.dat
index ca3cebc0a..4b696b90f 100644
--- a/testing/tests/p2pnat/medsrv-psk/posttest.dat
+++ b/testing/tests/p2pnat/medsrv-psk/posttest.dat
@@ -1,10 +1,10 @@
bob::ipsec stop
alice::ipsec stop
carol::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
-bob::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+bob::iptables-restore < /etc/iptables.flush
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::conntrack -F
sun::conntrack -F
diff --git a/testing/tests/p2pnat/medsrv-psk/pretest.dat b/testing/tests/p2pnat/medsrv-psk/pretest.dat
index fba7be01d..09b658318 100644
--- a/testing/tests/p2pnat/medsrv-psk/pretest.dat
+++ b/testing/tests/p2pnat/medsrv-psk/pretest.dat
@@ -1,8 +1,8 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
-bob::/etc/init.d/iptables start 2> /dev/null
+alice::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+bob::iptables-restore < /etc/iptables.rules
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
@@ -15,5 +15,5 @@ carol::ipsec start
carol::sleep 1
bob::ipsec start
bob::sleep 1
-alice::ipsec start
-alice::sleep 4
+alice::ipsec start
+alice::sleep 4
diff --git a/testing/tests/p2pnat/medsrv-psk/test.conf b/testing/tests/p2pnat/medsrv-psk/test.conf
index 2dc4cd8c1..a1c6b8c15 100644
--- a/testing/tests/p2pnat/medsrv-psk/test.conf
+++ b/testing/tests/p2pnat/medsrv-psk/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou sun bob"
+VIRTHOSTS="alice moon carol winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-s-b-med.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice carol bob"
diff --git a/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat b/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat
index 9ca168e82..590b7fe9c 100644
--- a/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat
+++ b/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES
-moon:: ip xfrm state::auth xcbc(aes)::YES
-carol::ip xfrm state::auth xcbc(aes)::YES
+moon:: ip xfrm state::auth-trunc xcbc(aes)::YES
+carol::ip xfrm state::auth-trunc xcbc(aes)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
diff --git a/testing/tests/pfkey/alg-aes-xcbc/posttest.dat b/testing/tests/pfkey/alg-aes-xcbc/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/pfkey/alg-aes-xcbc/posttest.dat
+++ b/testing/tests/pfkey/alg-aes-xcbc/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/alg-aes-xcbc/pretest.dat b/testing/tests/pfkey/alg-aes-xcbc/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/pfkey/alg-aes-xcbc/pretest.dat
+++ b/testing/tests/pfkey/alg-aes-xcbc/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/pfkey/alg-aes-xcbc/test.conf b/testing/tests/pfkey/alg-aes-xcbc/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/pfkey/alg-aes-xcbc/test.conf
+++ b/testing/tests/pfkey/alg-aes-xcbc/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/pfkey/alg-sha384/evaltest.dat b/testing/tests/pfkey/alg-sha384/evaltest.dat
index 21b3d5a4f..3b24217c5 100644
--- a/testing/tests/pfkey/alg-sha384/evaltest.dat
+++ b/testing/tests/pfkey/alg-sha384/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_3072::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_192/HMAC_SHA2_384_192,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_192/HMAC_SHA2_384_192,::YES
-moon:: ip xfrm state::auth hmac(sha384)::YES
-carol::ip xfrm state::auth hmac(sha384)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha384)::YES
+carol::ip xfrm state::auth-trunc hmac(sha384)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES
diff --git a/testing/tests/pfkey/alg-sha384/posttest.dat b/testing/tests/pfkey/alg-sha384/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/pfkey/alg-sha384/posttest.dat
+++ b/testing/tests/pfkey/alg-sha384/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/alg-sha384/pretest.dat b/testing/tests/pfkey/alg-sha384/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/pfkey/alg-sha384/pretest.dat
+++ b/testing/tests/pfkey/alg-sha384/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/pfkey/alg-sha384/test.conf b/testing/tests/pfkey/alg-sha384/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/pfkey/alg-sha384/test.conf
+++ b/testing/tests/pfkey/alg-sha384/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/pfkey/alg-sha512/evaltest.dat b/testing/tests/pfkey/alg-sha512/evaltest.dat
index 7b94d2182..6bdceeb44 100644
--- a/testing/tests/pfkey/alg-sha512/evaltest.dat
+++ b/testing/tests/pfkey/alg-sha512/evaltest.dat
@@ -4,10 +4,10 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES
carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096::YES
-carol::ping -c 1 -s 120 -p deadbeef 10.1.0.10::128 bytes from 10.1.0.10: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_256/HMAC_SHA2_512_256,::YES
carol::ipsec statusall 2> /dev/null::home.*AES_CBC_256/HMAC_SHA2_512_256,::YES
-moon:: ip xfrm state::auth hmac(sha512)::YES
-carol::ip xfrm state::auth hmac(sha512)::YES
+moon:: ip xfrm state::auth-trunc hmac(sha512)::YES
+carol::ip xfrm state::auth-trunc hmac(sha512)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 216::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 216::YES
diff --git a/testing/tests/pfkey/alg-sha512/posttest.dat b/testing/tests/pfkey/alg-sha512/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/pfkey/alg-sha512/posttest.dat
+++ b/testing/tests/pfkey/alg-sha512/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/alg-sha512/pretest.dat b/testing/tests/pfkey/alg-sha512/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/pfkey/alg-sha512/pretest.dat
+++ b/testing/tests/pfkey/alg-sha512/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/pfkey/alg-sha512/test.conf b/testing/tests/pfkey/alg-sha512/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/pfkey/alg-sha512/test.conf
+++ b/testing/tests/pfkey/alg-sha512/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/pfkey/esp-alg-null/evaltest.dat b/testing/tests/pfkey/esp-alg-null/evaltest.dat
index 271e274c8..c50b188bb 100644
--- a/testing/tests/pfkey/esp-alg-null/evaltest.dat
+++ b/testing/tests/pfkey/esp-alg-null/evaltest.dat
@@ -2,7 +2,7 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES
carol::ipsec statusall 2> /dev/null::NULL/HMAC_SHA1_96::YES
moon:: ip xfrm state::enc ecb(cipher_null)::YES
diff --git a/testing/tests/pfkey/esp-alg-null/posttest.dat b/testing/tests/pfkey/esp-alg-null/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/pfkey/esp-alg-null/posttest.dat
+++ b/testing/tests/pfkey/esp-alg-null/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/esp-alg-null/pretest.dat b/testing/tests/pfkey/esp-alg-null/pretest.dat
index f360351e1..4fc25772b 100644
--- a/testing/tests/pfkey/esp-alg-null/pretest.dat
+++ b/testing/tests/pfkey/esp-alg-null/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/pfkey/esp-alg-null/test.conf b/testing/tests/pfkey/esp-alg-null/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/pfkey/esp-alg-null/test.conf
+++ b/testing/tests/pfkey/esp-alg-null/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/pfkey/host2host-transport/evaltest.dat b/testing/tests/pfkey/host2host-transport/evaltest.dat
index 5ef5bed9c..fbd0c1c96 100644
--- a/testing/tests/pfkey/host2host-transport/evaltest.dat
+++ b/testing/tests/pfkey/host2host-transport/evaltest.dat
@@ -5,6 +5,6 @@ sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TRANSPORT::YES
moon::cat /var/log/daemon.log::parsed IKE_AUTH response.*N(USE_TRANSP)::YES
moon::ip xfrm state::mode transport::YES
sun:: ip xfrm state::mode transport::YES
-moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/pfkey/host2host-transport/posttest.dat b/testing/tests/pfkey/host2host-transport/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/pfkey/host2host-transport/posttest.dat
+++ b/testing/tests/pfkey/host2host-transport/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/host2host-transport/pretest.dat b/testing/tests/pfkey/host2host-transport/pretest.dat
index e2d98f2eb..99789b90f 100644
--- a/testing/tests/pfkey/host2host-transport/pretest.dat
+++ b/testing/tests/pfkey/host2host-transport/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 2
diff --git a/testing/tests/pfkey/host2host-transport/test.conf b/testing/tests/pfkey/host2host-transport/test.conf
index cf2e704fd..5a286c84f 100644
--- a/testing/tests/pfkey/host2host-transport/test.conf
+++ b/testing/tests/pfkey/host2host-transport/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="moon winnetou sun"
+VIRTHOSTS="moon winnetou sun"
# Corresponding block diagram
#
DIAGRAM="m-w-s.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/pfkey/nat-rw/evaltest.dat b/testing/tests/pfkey/nat-rw/evaltest.dat
index a0b9c678f..ac09e2d6b 100644
--- a/testing/tests/pfkey/nat-rw/evaltest.dat
+++ b/testing/tests/pfkey/nat-rw/evaltest.dat
@@ -6,7 +6,7 @@ alice::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES
venus::ipsec status 2> /dev/null::nat-t.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::nat-t[{]1}.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::nat-t[{]2}.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
-moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.4500: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.4500 > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules b/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules
new file mode 100644
index 000000000..ae8f9a61e
--- /dev/null
+++ b/testing/tests/pfkey/nat-rw/hosts/sun/etc/iptables.rules
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/pfkey/nat-rw/posttest.dat b/testing/tests/pfkey/nat-rw/posttest.dat
index 52572ece8..4643a3a7b 100644
--- a/testing/tests/pfkey/nat-rw/posttest.dat
+++ b/testing/tests/pfkey/nat-rw/posttest.dat
@@ -1,8 +1,8 @@
sun::ipsec stop
alice::ipsec stop
venus::ipsec stop
-alice::/etc/init.d/iptables stop 2> /dev/null
-venus::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+alice::iptables-restore < /etc/iptables.flush
+venus::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::iptables -t nat -F
moon::conntrack -F
diff --git a/testing/tests/pfkey/nat-rw/pretest.dat b/testing/tests/pfkey/nat-rw/pretest.dat
index e365ff5c5..d701a1d61 100644
--- a/testing/tests/pfkey/nat-rw/pretest.dat
+++ b/testing/tests/pfkey/nat-rw/pretest.dat
@@ -1,7 +1,6 @@
-alice::/etc/init.d/iptables start 2> /dev/null
-venus::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
-moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+alice::iptables-restore < /etc/iptables.rules
+venus::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
alice::ipsec start
diff --git a/testing/tests/pfkey/nat-rw/test.conf b/testing/tests/pfkey/nat-rw/test.conf
index 84317fd70..f515d4bc7 100644
--- a/testing/tests/pfkey/nat-rw/test.conf
+++ b/testing/tests/pfkey/nat-rw/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/pfkey/net2net-route/evaltest.dat b/testing/tests/pfkey/net2net-route/evaltest.dat
index 9adb31e97..1de6ca8e1 100644
--- a/testing/tests/pfkey/net2net-route/evaltest.dat
+++ b/testing/tests/pfkey/net2net-route/evaltest.dat
@@ -4,6 +4,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/pfkey/net2net-route/posttest.dat b/testing/tests/pfkey/net2net-route/posttest.dat
index 5a9150bc8..1f7aa73a1 100644
--- a/testing/tests/pfkey/net2net-route/posttest.dat
+++ b/testing/tests/pfkey/net2net-route/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/net2net-route/pretest.dat b/testing/tests/pfkey/net2net-route/pretest.dat
index 2eef7de19..e4ee3fac2 100644
--- a/testing/tests/pfkey/net2net-route/pretest.dat
+++ b/testing/tests/pfkey/net2net-route/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 2
diff --git a/testing/tests/pfkey/net2net-route/test.conf b/testing/tests/pfkey/net2net-route/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/pfkey/net2net-route/test.conf
+++ b/testing/tests/pfkey/net2net-route/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/pfkey/protoport-dual/evaltest.dat b/testing/tests/pfkey/protoport-dual/evaltest.dat
index d2fc698f9..50b53cc00 100644
--- a/testing/tests/pfkey/protoport-dual/evaltest.dat
+++ b/testing/tests/pfkey/protoport-dual/evaltest.dat
@@ -4,8 +4,8 @@ carol::ipsec status 2> /dev/null::home-icmp.*INSTALLED, TUNNEL::YES
carol::ipsec status 2> /dev/null::home-ssh.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-icmp.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-ssh.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/pfkey/protoport-dual/posttest.dat b/testing/tests/pfkey/protoport-dual/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/pfkey/protoport-dual/posttest.dat
+++ b/testing/tests/pfkey/protoport-dual/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/protoport-dual/pretest.dat b/testing/tests/pfkey/protoport-dual/pretest.dat
index d3d0061c3..efb2e5712 100644
--- a/testing/tests/pfkey/protoport-dual/pretest.dat
+++ b/testing/tests/pfkey/protoport-dual/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 2
diff --git a/testing/tests/pfkey/protoport-dual/test.conf b/testing/tests/pfkey/protoport-dual/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/pfkey/protoport-dual/test.conf
+++ b/testing/tests/pfkey/protoport-dual/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/pfkey/protoport-route/evaltest.dat b/testing/tests/pfkey/protoport-route/evaltest.dat
index 09dfd8f42..9e970f055 100644
--- a/testing/tests/pfkey/protoport-route/evaltest.dat
+++ b/testing/tests/pfkey/protoport-route/evaltest.dat
@@ -1,5 +1,5 @@
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES
-carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req::YES
carol::ssh PH_IP_ALICE hostname::alice::YES
carol::cat /var/log/daemon.log::creating acquire job::YES
carol::ipsec status 2> /dev/null::home-icmp.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
diff --git a/testing/tests/pfkey/protoport-route/posttest.dat b/testing/tests/pfkey/protoport-route/posttest.dat
index 94a400606..046d4cfdc 100644
--- a/testing/tests/pfkey/protoport-route/posttest.dat
+++ b/testing/tests/pfkey/protoport-route/posttest.dat
@@ -1,4 +1,4 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/protoport-route/pretest.dat b/testing/tests/pfkey/protoport-route/pretest.dat
index 0aded0f4d..5a15574d6 100644
--- a/testing/tests/pfkey/protoport-route/pretest.dat
+++ b/testing/tests/pfkey/protoport-route/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/pfkey/protoport-route/test.conf b/testing/tests/pfkey/protoport-route/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/pfkey/protoport-route/test.conf
+++ b/testing/tests/pfkey/protoport-route/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/pfkey/rw-cert/evaltest.dat b/testing/tests/pfkey/rw-cert/evaltest.dat
index b545c2289..2342d024b 100644
--- a/testing/tests/pfkey/rw-cert/evaltest.dat
+++ b/testing/tests/pfkey/rw-cert/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/pfkey/rw-cert/posttest.dat b/testing/tests/pfkey/rw-cert/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/pfkey/rw-cert/posttest.dat
+++ b/testing/tests/pfkey/rw-cert/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/rw-cert/pretest.dat b/testing/tests/pfkey/rw-cert/pretest.dat
index 42e9d7c24..8bbea1412 100644
--- a/testing/tests/pfkey/rw-cert/pretest.dat
+++ b/testing/tests/pfkey/rw-cert/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/pfkey/rw-cert/test.conf b/testing/tests/pfkey/rw-cert/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/pfkey/rw-cert/test.conf
+++ b/testing/tests/pfkey/rw-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/pfkey/shunt-policies/evaltest.dat b/testing/tests/pfkey/shunt-policies/evaltest.dat
index 87368fb31..6ba3a988f 100644
--- a/testing/tests/pfkey/shunt-policies/evaltest.dat
+++ b/testing/tests/pfkey/shunt-policies/evaltest.dat
@@ -4,16 +4,16 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO
-venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO
+venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
venus::ssh PH_IP_BOB hostname::bob::YES
diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 2b90a14c7..000000000
--- a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow icmp in local net
- iptables -A INPUT -i eth1 -p icmp -j ACCEPT
- iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..af0f25209
--- /dev/null
+++ b/testing/tests/pfkey/shunt-policies/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow icmp in local net
+-A INPUT -i eth1 -p icmp -j ACCEPT
+-A OUTPUT -o eth1 -p icmp -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/pfkey/shunt-policies/posttest.dat b/testing/tests/pfkey/shunt-policies/posttest.dat
index a4c96e10f..837738fc6 100644
--- a/testing/tests/pfkey/shunt-policies/posttest.dat
+++ b/testing/tests/pfkey/shunt-policies/posttest.dat
@@ -1,5 +1,5 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/pfkey/shunt-policies/pretest.dat b/testing/tests/pfkey/shunt-policies/pretest.dat
index 2d7a78acb..c724e5df8 100644
--- a/testing/tests/pfkey/shunt-policies/pretest.dat
+++ b/testing/tests/pfkey/shunt-policies/pretest.dat
@@ -1,5 +1,5 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/pfkey/shunt-policies/test.conf b/testing/tests/pfkey/shunt-policies/test.conf
index cf2ef7424..6b7432ca6 100644
--- a/testing/tests/pfkey/shunt-policies/test.conf
+++ b/testing/tests/pfkey/shunt-policies/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/sql/ip-pool-db-expired/evaltest.dat b/testing/tests/sql/ip-pool-db-expired/evaltest.dat
index 3239dfe1f..5ff5edbf8 100644
--- a/testing/tests/sql/ip-pool-db-expired/evaltest.dat
+++ b/testing/tests/sql/ip-pool-db-expired/evaltest.dat
@@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
diff --git a/testing/tests/sql/ip-pool-db-expired/posttest.dat b/testing/tests/sql/ip-pool-db-expired/posttest.dat
index 40b1a403e..1b963fcec 100644
--- a/testing/tests/sql/ip-pool-db-expired/posttest.dat
+++ b/testing/tests/sql/ip-pool-db-expired/posttest.dat
@@ -1,9 +1,9 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
carol::rm /etc/ipsec.d/ipsec.*
dave::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/ip-pool-db-expired/pretest.dat b/testing/tests/sql/ip-pool-db-expired/pretest.dat
index 4df33509f..391785a1c 100644
--- a/testing/tests/sql/ip-pool-db-expired/pretest.dat
+++ b/testing/tests/sql/ip-pool-db-expired/pretest.dat
@@ -8,9 +8,9 @@ moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
moon::ipsec pool --leases 2> /dev/null
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/ip-pool-db-expired/test.conf b/testing/tests/sql/ip-pool-db-expired/test.conf
index 75510b295..9b1ec0b54 100644
--- a/testing/tests/sql/ip-pool-db-expired/test.conf
+++ b/testing/tests/sql/ip-pool-db-expired/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/ip-pool-db-restart/evaltest.dat b/testing/tests/sql/ip-pool-db-restart/evaltest.dat
index 58706fa48..f70e2d2de 100644
--- a/testing/tests/sql/ip-pool-db-restart/evaltest.dat
+++ b/testing/tests/sql/ip-pool-db-restart/evaltest.dat
@@ -3,13 +3,13 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
moon:: cat /var/log/daemon.log::acquired existing lease for address.*in pool.*bigpool::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
diff --git a/testing/tests/sql/ip-pool-db-restart/posttest.dat b/testing/tests/sql/ip-pool-db-restart/posttest.dat
index 40b1a403e..1b963fcec 100644
--- a/testing/tests/sql/ip-pool-db-restart/posttest.dat
+++ b/testing/tests/sql/ip-pool-db-restart/posttest.dat
@@ -1,9 +1,9 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
carol::rm /etc/ipsec.d/ipsec.*
dave::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/ip-pool-db-restart/pretest.dat b/testing/tests/sql/ip-pool-db-restart/pretest.dat
index b5108051c..20b1937b7 100644
--- a/testing/tests/sql/ip-pool-db-restart/pretest.dat
+++ b/testing/tests/sql/ip-pool-db-restart/pretest.dat
@@ -8,9 +8,9 @@ moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
moon::ipsec pool --leases 2> /dev/null
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/ip-pool-db-restart/test.conf b/testing/tests/sql/ip-pool-db-restart/test.conf
index 75510b295..9b1ec0b54 100644
--- a/testing/tests/sql/ip-pool-db-restart/test.conf
+++ b/testing/tests/sql/ip-pool-db-restart/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/ip-pool-db/evaltest.dat b/testing/tests/sql/ip-pool-db/evaltest.dat
index 3910ab9c2..cfa87ae3f 100644
--- a/testing/tests/sql/ip-pool-db/evaltest.dat
+++ b/testing/tests/sql/ip-pool-db/evaltest.dat
@@ -7,7 +7,7 @@ carol::ip addr list dev eth0::PH_IP_CAROL1::YES
carol::ip route list table 220::10.1.0.0/16.*src PH_IP_CAROL1::YES
carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
dave:: cat /var/log/daemon.log::installing DNS server PH_IP_WINNETOU::YES
@@ -18,7 +18,7 @@ dave:: ip addr list dev eth0::PH_IP_DAVE1::YES
dave:: ip route list table 220::10.1.0.0/16.*src PH_IP_DAVE1::YES
dave:: ipsec status 2> /dev/null::.*ESTABLISHED.*dave@strongswan.org.*moon.strongswan.org::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon:: cat /var/log/daemon.log::peer requested virtual IP %any::YES
moon:: cat /var/log/daemon.log::acquired new lease for address.*in pool.*bigpool::YES
moon:: cat /var/log/daemon.log::assigning virtual IP::YES
diff --git a/testing/tests/sql/ip-pool-db/posttest.dat b/testing/tests/sql/ip-pool-db/posttest.dat
index 40b1a403e..1b963fcec 100644
--- a/testing/tests/sql/ip-pool-db/posttest.dat
+++ b/testing/tests/sql/ip-pool-db/posttest.dat
@@ -1,9 +1,9 @@
carol::ipsec stop
dave::ipsec stop
moon::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
carol::rm /etc/ipsec.d/ipsec.*
dave::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/ip-pool-db/pretest.dat b/testing/tests/sql/ip-pool-db/pretest.dat
index a5d786b3f..819aca3d9 100644
--- a/testing/tests/sql/ip-pool-db/pretest.dat
+++ b/testing/tests/sql/ip-pool-db/pretest.dat
@@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/ip-pool-db/test.conf b/testing/tests/sql/ip-pool-db/test.conf
index 75510b295..9b1ec0b54 100644
--- a/testing/tests/sql/ip-pool-db/test.conf
+++ b/testing/tests/sql/ip-pool-db/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/ip-split-pools-db-restart/test.conf b/testing/tests/sql/ip-split-pools-db-restart/test.conf
index 75510b295..9b1ec0b54 100644
--- a/testing/tests/sql/ip-split-pools-db-restart/test.conf
+++ b/testing/tests/sql/ip-split-pools-db-restart/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/ip-split-pools-db/test.conf b/testing/tests/sql/ip-split-pools-db/test.conf
index 75510b295..9b1ec0b54 100644
--- a/testing/tests/sql/ip-split-pools-db/test.conf
+++ b/testing/tests/sql/ip-split-pools-db/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="alice moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/multi-level-ca/evaltest.dat b/testing/tests/sql/multi-level-ca/evaltest.dat
index dfdd36a51..72a555d4b 100644
--- a/testing/tests/sql/multi-level-ca/evaltest.dat
+++ b/testing/tests/sql/multi-level-ca/evaltest.dat
@@ -14,8 +14,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/multi-level-ca/posttest.dat b/testing/tests/sql/multi-level-ca/posttest.dat
index d4d57ad83..e9ad4bea6 100644
--- a/testing/tests/sql/multi-level-ca/posttest.dat
+++ b/testing/tests/sql/multi-level-ca/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
carol::rm /etc/ipsec.d/ipsec.*
dave::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/multi-level-ca/pretest.dat b/testing/tests/sql/multi-level-ca/pretest.dat
index 76316f33d..fdd4df5f9 100644
--- a/testing/tests/sql/multi-level-ca/pretest.dat
+++ b/testing/tests/sql/multi-level-ca/pretest.dat
@@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/multi-level-ca/test.conf b/testing/tests/sql/multi-level-ca/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/sql/multi-level-ca/test.conf
+++ b/testing/tests/sql/multi-level-ca/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/net2net-cert/evaltest.dat b/testing/tests/sql/net2net-cert/evaltest.dat
index dbd06104f..f003f822f 100644
--- a/testing/tests/sql/net2net-cert/evaltest.dat
+++ b/testing/tests/sql/net2net-cert/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/net2net-cert/posttest.dat b/testing/tests/sql/net2net-cert/posttest.dat
index 13f7ede0a..329a572b2 100644
--- a/testing/tests/sql/net2net-cert/posttest.dat
+++ b/testing/tests/sql/net2net-cert/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
sun::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/net2net-cert/pretest.dat b/testing/tests/sql/net2net-cert/pretest.dat
index 2ab18542f..a1777efb0 100644
--- a/testing/tests/sql/net2net-cert/pretest.dat
+++ b/testing/tests/sql/net2net-cert/pretest.dat
@@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/sql/net2net-cert/test.conf b/testing/tests/sql/net2net-cert/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/sql/net2net-cert/test.conf
+++ b/testing/tests/sql/net2net-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/sql/net2net-psk/evaltest.dat b/testing/tests/sql/net2net-psk/evaltest.dat
index dbd06104f..f003f822f 100644
--- a/testing/tests/sql/net2net-psk/evaltest.dat
+++ b/testing/tests/sql/net2net-psk/evaltest.dat
@@ -2,6 +2,6 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/net2net-psk/posttest.dat b/testing/tests/sql/net2net-psk/posttest.dat
index 13f7ede0a..329a572b2 100644
--- a/testing/tests/sql/net2net-psk/posttest.dat
+++ b/testing/tests/sql/net2net-psk/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
sun::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/net2net-psk/pretest.dat b/testing/tests/sql/net2net-psk/pretest.dat
index 2ab18542f..a1777efb0 100644
--- a/testing/tests/sql/net2net-psk/pretest.dat
+++ b/testing/tests/sql/net2net-psk/pretest.dat
@@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/sql/net2net-psk/test.conf b/testing/tests/sql/net2net-psk/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/sql/net2net-psk/test.conf
+++ b/testing/tests/sql/net2net-psk/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/sql/net2net-route-pem/evaltest.dat b/testing/tests/sql/net2net-route-pem/evaltest.dat
index 719ba09ff..3fd32907c 100644
--- a/testing/tests/sql/net2net-route-pem/evaltest.dat
+++ b/testing/tests/sql/net2net-route-pem/evaltest.dat
@@ -10,7 +10,7 @@ moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
moon:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/net2net-route-pem/posttest.dat b/testing/tests/sql/net2net-route-pem/posttest.dat
index 13f7ede0a..329a572b2 100644
--- a/testing/tests/sql/net2net-route-pem/posttest.dat
+++ b/testing/tests/sql/net2net-route-pem/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
sun::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/net2net-route-pem/pretest.dat b/testing/tests/sql/net2net-route-pem/pretest.dat
index 5a537e15b..8ca573ee5 100644
--- a/testing/tests/sql/net2net-route-pem/pretest.dat
+++ b/testing/tests/sql/net2net-route-pem/pretest.dat
@@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
sun::ipsec start
moon::ipsec start
moon::sleep 1
diff --git a/testing/tests/sql/net2net-route-pem/test.conf b/testing/tests/sql/net2net-route-pem/test.conf
index 13a8a2a48..10c582c9b 100644
--- a/testing/tests/sql/net2net-route-pem/test.conf
+++ b/testing/tests/sql/net2net-route-pem/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/sql/net2net-start-pem/evaltest.dat b/testing/tests/sql/net2net-start-pem/evaltest.dat
index e6b8890f9..6534adc07 100644
--- a/testing/tests/sql/net2net-start-pem/evaltest.dat
+++ b/testing/tests/sql/net2net-start-pem/evaltest.dat
@@ -6,7 +6,7 @@ moon:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-2.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::net-3.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-3.*INSTALLED, TUNNEL::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/net2net-start-pem/posttest.dat b/testing/tests/sql/net2net-start-pem/posttest.dat
index 13f7ede0a..329a572b2 100644
--- a/testing/tests/sql/net2net-start-pem/posttest.dat
+++ b/testing/tests/sql/net2net-start-pem/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
sun::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/net2net-start-pem/pretest.dat b/testing/tests/sql/net2net-start-pem/pretest.dat
index c09d50f08..1c71f0c14 100644
--- a/testing/tests/sql/net2net-start-pem/pretest.dat
+++ b/testing/tests/sql/net2net-start-pem/pretest.dat
@@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
sun::ipsec start
moon::ipsec start
moon::sleep 3
diff --git a/testing/tests/sql/net2net-start-pem/test.conf b/testing/tests/sql/net2net-start-pem/test.conf
index 13a8a2a48..10c582c9b 100644
--- a/testing/tests/sql/net2net-start-pem/test.conf
+++ b/testing/tests/sql/net2net-start-pem/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon winnetou sun bob"
+VIRTHOSTS="alice venus moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-v-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/sql/rw-cert/evaltest.dat b/testing/tests/sql/rw-cert/evaltest.dat
index b545c2289..2342d024b 100644
--- a/testing/tests/sql/rw-cert/evaltest.dat
+++ b/testing/tests/sql/rw-cert/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/rw-cert/posttest.dat b/testing/tests/sql/rw-cert/posttest.dat
index d4d57ad83..e9ad4bea6 100644
--- a/testing/tests/sql/rw-cert/posttest.dat
+++ b/testing/tests/sql/rw-cert/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
carol::rm /etc/ipsec.d/ipsec.*
dave::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/rw-cert/pretest.dat b/testing/tests/sql/rw-cert/pretest.dat
index 76316f33d..fdd4df5f9 100644
--- a/testing/tests/sql/rw-cert/pretest.dat
+++ b/testing/tests/sql/rw-cert/pretest.dat
@@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/rw-cert/test.conf b/testing/tests/sql/rw-cert/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/sql/rw-cert/test.conf
+++ b/testing/tests/sql/rw-cert/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat b/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat
index 65a7c8e09..e1d33feb7 100644
--- a/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat
+++ b/testing/tests/sql/rw-eap-aka-rsa/evaltest.dat
@@ -5,7 +5,7 @@ carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.
moon:: ipsec status 2> /dev/null::rw-eap-aka.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw-eap-aka.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/rw-eap-aka-rsa/posttest.dat b/testing/tests/sql/rw-eap-aka-rsa/posttest.dat
index 23eeb0d17..584356d8e 100644
--- a/testing/tests/sql/rw-eap-aka-rsa/posttest.dat
+++ b/testing/tests/sql/rw-eap-aka-rsa/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
carol::rm /etc/ipsec.d/ipsec.*
~
diff --git a/testing/tests/sql/rw-eap-aka-rsa/pretest.dat b/testing/tests/sql/rw-eap-aka-rsa/pretest.dat
index b78fd480f..8f2387ba1 100644
--- a/testing/tests/sql/rw-eap-aka-rsa/pretest.dat
+++ b/testing/tests/sql/rw-eap-aka-rsa/pretest.dat
@@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
carol::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
carol::sleep 1
diff --git a/testing/tests/sql/rw-eap-aka-rsa/test.conf b/testing/tests/sql/rw-eap-aka-rsa/test.conf
index 9cd583b16..4a5fc470f 100644
--- a/testing/tests/sql/rw-eap-aka-rsa/test.conf
+++ b/testing/tests/sql/rw-eap-aka-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou"
+VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
diff --git a/testing/tests/sql/rw-psk-ipv4/evaltest.dat b/testing/tests/sql/rw-psk-ipv4/evaltest.dat
index 1ad36fcaf..eaf47395e 100644
--- a/testing/tests/sql/rw-psk-ipv4/evaltest.dat
+++ b/testing/tests/sql/rw-psk-ipv4/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/rw-psk-ipv4/posttest.dat b/testing/tests/sql/rw-psk-ipv4/posttest.dat
index d4d57ad83..e9ad4bea6 100644
--- a/testing/tests/sql/rw-psk-ipv4/posttest.dat
+++ b/testing/tests/sql/rw-psk-ipv4/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
carol::rm /etc/ipsec.d/ipsec.*
dave::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/rw-psk-ipv4/pretest.dat b/testing/tests/sql/rw-psk-ipv4/pretest.dat
index 76316f33d..fdd4df5f9 100644
--- a/testing/tests/sql/rw-psk-ipv4/pretest.dat
+++ b/testing/tests/sql/rw-psk-ipv4/pretest.dat
@@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/rw-psk-ipv4/test.conf b/testing/tests/sql/rw-psk-ipv4/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/sql/rw-psk-ipv4/test.conf
+++ b/testing/tests/sql/rw-psk-ipv4/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables
deleted file mode 100755
index 25074a0f1..000000000
--- a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/init.d/iptables
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow last UDP fragment
- ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules
new file mode 100644
index 000000000..7362b2e25
--- /dev/null
+++ b/testing/tests/sql/rw-psk-ipv6/hosts/carol/etc/iptables.rules
@@ -0,0 +1,16 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables
deleted file mode 100755
index 25074a0f1..000000000
--- a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/init.d/iptables
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow last UDP fragment
- ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules
new file mode 100644
index 000000000..7362b2e25
--- /dev/null
+++ b/testing/tests/sql/rw-psk-ipv6/hosts/dave/etc/iptables.rules
@@ -0,0 +1,16 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 25074a0f1..000000000
--- a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- /sbin/ip6tables -P INPUT DROP
- /sbin/ip6tables -P OUTPUT DROP
- /sbin/ip6tables -P FORWARD DROP
-
- # allow esp
- ip6tables -A INPUT -i eth0 -p 50 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- ip6tables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- ip6tables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- ip6tables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow last UDP fragment
- ip6tables -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT
-
- # allow ICMPv6 neighbor-solicitations
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-
- # allow ICMPv6 neighbor-advertisements
- ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
- ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # log dropped packets
- ip6tables -A INPUT -j LOG --log-prefix " IN: "
- ip6tables -A OUTPUT -j LOG --log-prefix " OUT: "
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
-
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/ip6tables -t filter -P INPUT ACCEPT
- /sbin/ip6tables -t filter -P FORWARD ACCEPT
- /sbin/ip6tables -t filter -P OUTPUT ACCEPT
-
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/ip6tables -F -t $a
- /sbin/ip6tables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..7362b2e25
--- /dev/null
+++ b/testing/tests/sql/rw-psk-ipv6/hosts/moon/etc/iptables.rules
@@ -0,0 +1,16 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/sql/rw-psk-ipv6/posttest.dat b/testing/tests/sql/rw-psk-ipv6/posttest.dat
index bdfd9ed00..ab753507f 100644
--- a/testing/tests/sql/rw-psk-ipv6/posttest.dat
+++ b/testing/tests/sql/rw-psk-ipv6/posttest.dat
@@ -1,9 +1,12 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+carol::ip6tables-restore < /etc/ip6tables.flush
+dave::ip6tables-restore < /etc/ip6tables.flush
alice::"ip route del fec0:\:/16 via fec1:\:1"
carol::"ip route del fec1:\:/16 via fec0:\:1"
dave::"ip route del fec1:\:/16 via fec0:\:1"
diff --git a/testing/tests/sql/rw-psk-ipv6/pretest.dat b/testing/tests/sql/rw-psk-ipv6/pretest.dat
index 253438dbf..587dd7f85 100644
--- a/testing/tests/sql/rw-psk-ipv6/pretest.dat
+++ b/testing/tests/sql/rw-psk-ipv6/pretest.dat
@@ -7,9 +7,12 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+moon::ip6tables-restore < /etc/ip6tables.rules
+carol::ip6tables-restore < /etc/ip6tables.rules
+dave::ip6tables-restore < /etc/ip6tables.rules
alice::"ip route add fec0:\:/16 via fec1:\:1"
carol::"ip route add fec1:\:/16 via fec0:\:1"
dave::"ip route add fec1:\:/16 via fec0:\:1"
diff --git a/testing/tests/sql/rw-psk-ipv6/test.conf b/testing/tests/sql/rw-psk-ipv6/test.conf
index 80cf5e3a1..05bb8ab6d 100644
--- a/testing/tests/sql/rw-psk-ipv6/test.conf
+++ b/testing/tests/sql/rw-psk-ipv6/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d-ip6.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/rw-psk-rsa-split/evaltest.dat b/testing/tests/sql/rw-psk-rsa-split/evaltest.dat
index 9a1ab3f8f..1648c9557 100644
--- a/testing/tests/sql/rw-psk-rsa-split/evaltest.dat
+++ b/testing/tests/sql/rw-psk-rsa-split/evaltest.dat
@@ -9,8 +9,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/rw-psk-rsa-split/posttest.dat b/testing/tests/sql/rw-psk-rsa-split/posttest.dat
index d4d57ad83..e9ad4bea6 100644
--- a/testing/tests/sql/rw-psk-rsa-split/posttest.dat
+++ b/testing/tests/sql/rw-psk-rsa-split/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
carol::rm /etc/ipsec.d/ipsec.*
dave::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/rw-psk-rsa-split/pretest.dat b/testing/tests/sql/rw-psk-rsa-split/pretest.dat
index 76316f33d..fdd4df5f9 100644
--- a/testing/tests/sql/rw-psk-rsa-split/pretest.dat
+++ b/testing/tests/sql/rw-psk-rsa-split/pretest.dat
@@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/rw-psk-rsa-split/test.conf b/testing/tests/sql/rw-psk-rsa-split/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/sql/rw-psk-rsa-split/test.conf
+++ b/testing/tests/sql/rw-psk-rsa-split/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/rw-rsa-keyid/evaltest.dat b/testing/tests/sql/rw-rsa-keyid/evaltest.dat
index 26f82653a..4f5cd724c 100644
--- a/testing/tests/sql/rw-rsa-keyid/evaltest.dat
+++ b/testing/tests/sql/rw-rsa-keyid/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/rw-rsa-keyid/posttest.dat b/testing/tests/sql/rw-rsa-keyid/posttest.dat
index b10aeb3aa..892650ccb 100644
--- a/testing/tests/sql/rw-rsa-keyid/posttest.dat
+++ b/testing/tests/sql/rw-rsa-keyid/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.db
carol::rm /etc/ipsec.d/ipsec.db
dave::rm /etc/ipsec.d/ipsec.db
diff --git a/testing/tests/sql/rw-rsa-keyid/pretest.dat b/testing/tests/sql/rw-rsa-keyid/pretest.dat
index 76316f33d..fdd4df5f9 100644
--- a/testing/tests/sql/rw-rsa-keyid/pretest.dat
+++ b/testing/tests/sql/rw-rsa-keyid/pretest.dat
@@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/rw-rsa-keyid/test.conf b/testing/tests/sql/rw-rsa-keyid/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/sql/rw-rsa-keyid/test.conf
+++ b/testing/tests/sql/rw-rsa-keyid/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/rw-rsa/evaltest.dat b/testing/tests/sql/rw-rsa/evaltest.dat
index f8cfb111b..ba661975b 100644
--- a/testing/tests/sql/rw-rsa/evaltest.dat
+++ b/testing/tests/sql/rw-rsa/evaltest.dat
@@ -6,8 +6,8 @@ carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/sql/rw-rsa/posttest.dat b/testing/tests/sql/rw-rsa/posttest.dat
index b10aeb3aa..892650ccb 100644
--- a/testing/tests/sql/rw-rsa/posttest.dat
+++ b/testing/tests/sql/rw-rsa/posttest.dat
@@ -1,9 +1,9 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.db
carol::rm /etc/ipsec.d/ipsec.db
dave::rm /etc/ipsec.d/ipsec.db
diff --git a/testing/tests/sql/rw-rsa/pretest.dat b/testing/tests/sql/rw-rsa/pretest.dat
index 76316f33d..fdd4df5f9 100644
--- a/testing/tests/sql/rw-rsa/pretest.dat
+++ b/testing/tests/sql/rw-rsa/pretest.dat
@@ -7,9 +7,9 @@ dave::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::ipsec start
carol::ipsec start
dave::ipsec start
diff --git a/testing/tests/sql/rw-rsa/test.conf b/testing/tests/sql/rw-rsa/test.conf
index 70416826e..f29298850 100644
--- a/testing/tests/sql/rw-rsa/test.conf
+++ b/testing/tests/sql/rw-rsa/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/sql/shunt-policies/evaltest.dat b/testing/tests/sql/shunt-policies/evaltest.dat
index 70aea411e..51dd9610b 100644
--- a/testing/tests/sql/shunt-policies/evaltest.dat
+++ b/testing/tests/sql/shunt-policies/evaltest.dat
@@ -4,16 +4,16 @@ moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::local-net.*PASS::YES
moon:: ipsec status 2> /dev/null::venus-icmp.*DROP::YES
-alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::NO
-venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
-bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::NO
+venus::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+moon:: ping -c 1 -I PH_IP_MOON1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+moon:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_req=1::YES
+bob:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
venus::ssh PH_IP_BOB hostname::bob::YES
diff --git a/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables b/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 2b90a14c7..000000000
--- a/testing/tests/sql/shunt-policies/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- # allow icmp in local net
- iptables -A INPUT -i eth1 -p icmp -j ACCEPT
- iptables -A OUTPUT -o eth1 -p icmp -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules b/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..af0f25209
--- /dev/null
+++ b/testing/tests/sql/shunt-policies/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow icmp in local net
+-A INPUT -i eth1 -p icmp -j ACCEPT
+-A OUTPUT -o eth1 -p icmp -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/sql/shunt-policies/posttest.dat b/testing/tests/sql/shunt-policies/posttest.dat
index 13f7ede0a..329a572b2 100644
--- a/testing/tests/sql/shunt-policies/posttest.dat
+++ b/testing/tests/sql/shunt-policies/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
moon::rm /etc/ipsec.d/ipsec.*
sun::rm /etc/ipsec.d/ipsec.*
diff --git a/testing/tests/sql/shunt-policies/pretest.dat b/testing/tests/sql/shunt-policies/pretest.dat
index 2ab18542f..a1777efb0 100644
--- a/testing/tests/sql/shunt-policies/pretest.dat
+++ b/testing/tests/sql/shunt-policies/pretest.dat
@@ -4,8 +4,8 @@ moon::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
sun::cat /etc/ipsec.d/tables.sql /etc/ipsec.d/data.sql > /etc/ipsec.d/ipsec.sql
moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
sun::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
-moon::/etc/init.d/iptables start 2> /dev/null
-sun::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+sun::iptables-restore < /etc/iptables.rules
moon::ipsec start
sun::ipsec start
moon::sleep 1
diff --git a/testing/tests/sql/shunt-policies/test.conf b/testing/tests/sql/shunt-policies/test.conf
index d9a61590f..646b8b3e6 100644
--- a/testing/tests/sql/shunt-policies/test.conf
+++ b/testing/tests/sql/shunt-policies/test.conf
@@ -1,21 +1,21 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon winnetou sun bob"
+VIRTHOSTS="alice moon winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-w-s-b.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="sun"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon sun"
diff --git a/testing/tests/tnc/tnccs-11-fhh/evaltest.dat b/testing/tests/tnc/tnccs-11-fhh/evaltest.dat
index b6663ea5e..6b7c713ef 100644
--- a/testing/tests/tnc/tnccs-11-fhh/evaltest.dat
+++ b/testing/tests/tnc/tnccs-11-fhh/evaltest.dat
@@ -1,9 +1,9 @@
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-11-fhh/posttest.dat b/testing/tests/tnc/tnccs-11-fhh/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/tnc/tnccs-11-fhh/posttest.dat
+++ b/testing/tests/tnc/tnccs-11-fhh/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-11-fhh/pretest.dat b/testing/tests/tnc/tnccs-11-fhh/pretest.dat
index c7a30ee7c..997c70a8e 100644
--- a/testing/tests/tnc/tnccs-11-fhh/pretest.dat
+++ b/testing/tests/tnc/tnccs-11-fhh/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-11-fhh/test.conf b/testing/tests/tnc/tnccs-11-fhh/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-11-fhh/test.conf
+++ b/testing/tests/tnc/tnccs-11-fhh/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat b/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat
index b875eed49..d93407434 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat
+++ b/testing/tests/tnc/tnccs-11-radius-block/evaltest.dat
@@ -9,6 +9,6 @@ dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/3
moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES
moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave@strongswan.org' failed::YES
moon:: cat /var/log/daemon.log::EAP method EAP_TTLS failed for peer dave@strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/eap.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/eap.conf
index 31556361e..31556361e 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/eap.conf
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/proxy.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default
new file mode 100644
index 000000000..dd0825858
--- /dev/null
+++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/default
@@ -0,0 +1,43 @@
+authorize {
+ suffix
+ eap {
+ ok = return
+ }
+ files
+}
+
+authenticate {
+ eap
+}
+
+preacct {
+ preprocess
+ acct_unique
+ suffix
+ files
+}
+
+accounting {
+ detail
+ unix
+ radutmp
+ attr_filter.accounting_response
+}
+
+session {
+ radutmp
+}
+
+post-auth {
+ exec
+ Post-Auth-Type REJECT {
+ attr_filter.access_reject
+ }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+ eap
+}
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel
index e088fae14..e088fae14 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel
+++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel-second b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second
index 2d4961288..2d4961288 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/inner-tunnel-second
+++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/users b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/users
index 50ccf3e76..50ccf3e76 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/users
+++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary
deleted file mode 100644
index 1a27a02fc..000000000
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary
+++ /dev/null
@@ -1,2 +0,0 @@
-$INCLUDE /usr/share/freeradius/dictionary
-$INCLUDE /etc/raddb/dictionary.tnc
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc
deleted file mode 100644
index f295467a9..000000000
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/dictionary.tnc
+++ /dev/null
@@ -1,5 +0,0 @@
-ATTRIBUTE TNC-Status 3001 integer
-
-VALUE TNC-Status Access 0
-VALUE TNC-Status Isolate 1
-VALUE TNC-Status None 2
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index 1143a0473..000000000
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,120 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default b/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default
deleted file mode 100644
index 802fcfd8d..000000000
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/alice/etc/raddb/sites-available/default
+++ /dev/null
@@ -1,44 +0,0 @@
-authorize {
- suffix
- eap {
- ok = return
- }
- files
-}
-
-authenticate {
- eap
-}
-
-preacct {
- preprocess
- acct_unique
- suffix
- files
-}
-
-accounting {
- detail
- unix
- radutmp
- attr_filter.accounting_response
-}
-
-session {
- radutmp
-}
-
-post-auth {
- exec
- Post-Auth-Type REJECT {
- attr_filter.access_reject
- }
-}
-
-pre-proxy {
-}
-
-post-proxy {
- eap
-}
-
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/tnc/tnccs-11-radius-block/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/tnc/tnccs-11-radius-block/posttest.dat b/testing/tests/tnc/tnccs-11-radius-block/posttest.dat
index 51d8ca1b3..5e5a8514d 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/posttest.dat
+++ b/testing/tests/tnc/tnccs-11-radius-block/posttest.dat
@@ -2,8 +2,8 @@ moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
alice::killall radiusd
-alice::rm /etc/raddb/sites-enabled/inner-tunnel-second
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
dave::/etc/init.d/apache2 stop 2> /dev/null
diff --git a/testing/tests/tnc/tnccs-11-radius-block/pretest.dat b/testing/tests/tnc/tnccs-11-radius-block/pretest.dat
index 0fa88dbc7..c8f2139a8 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/pretest.dat
+++ b/testing/tests/tnc/tnccs-11-radius-block/pretest.dat
@@ -1,9 +1,9 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
dave::/etc/init.d/apache2 start 2> /dev/null
-alice::ln -s /etc/raddb/sites-available/inner-tunnel-second /etc/raddb/sites-enabled/inner-tunnel-second
-alice::cat /etc/raddb/sites-enabled/inner-tunnel-second
+alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second
+alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second
alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd
moon::ipsec start
carol::LEAK_DETECTIVE_DISABLE=1 ipsec start
diff --git a/testing/tests/tnc/tnccs-11-radius-block/test.conf b/testing/tests/tnc/tnccs-11-radius-block/test.conf
index bb6b68687..29bfaa78c 100644
--- a/testing/tests/tnc/tnccs-11-radius-block/test.conf
+++ b/testing/tests/tnc/tnccs-11-radius-block/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice moon carol winnetou dave"
+VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/tnc/tnccs-11-radius/evaltest.dat b/testing/tests/tnc/tnccs-11-radius/evaltest.dat
index d72239e8e..e22b767f7 100644
--- a/testing/tests/tnc/tnccs-11-radius/evaltest.dat
+++ b/testing/tests/tnc/tnccs-11-radius/evaltest.dat
@@ -1,10 +1,10 @@
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES
moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/eap.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/eap.conf
index 31556361e..31556361e 100644
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/eap.conf
+++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/eap.conf
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/proxy.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/proxy.conf
index 23cba8d11..23cba8d11 100644
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/proxy.conf
+++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/proxy.conf
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default
new file mode 100644
index 000000000..dd0825858
--- /dev/null
+++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/default
@@ -0,0 +1,43 @@
+authorize {
+ suffix
+ eap {
+ ok = return
+ }
+ files
+}
+
+authenticate {
+ eap
+}
+
+preacct {
+ preprocess
+ acct_unique
+ suffix
+ files
+}
+
+accounting {
+ detail
+ unix
+ radutmp
+ attr_filter.accounting_response
+}
+
+session {
+ radutmp
+}
+
+post-auth {
+ exec
+ Post-Auth-Type REJECT {
+ attr_filter.access_reject
+ }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+ eap
+}
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel
index e088fae14..e088fae14 100644
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel
+++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel-second b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second
index f91bccc72..c5bde6a9e 100644
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel-second
+++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/sites-available/inner-tunnel-second
@@ -17,14 +17,14 @@ session {
post-auth {
if (control:TNC-Status == "Access") {
update reply {
- Tunnel-Type := ESP
+ Tunnel-Type := ESP
Filter-Id := "allow"
}
}
elsif (control:TNC-Status == "Isolate") {
update reply {
- Tunnel-Type := ESP
- Filter-Id := "isolate"
+ Tunnel-Type := ESP
+ Filter-Id := "isolate"
}
}
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/users b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/users
index 50ccf3e76..50ccf3e76 100644
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/users
+++ b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/freeradius/users
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf
deleted file mode 100644
index f4e179aa4..000000000
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/clients.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-client PH_IP_MOON1 {
- secret = gv6URkSs
- shortname = moon
-}
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary
deleted file mode 100644
index 1a27a02fc..000000000
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary
+++ /dev/null
@@ -1,2 +0,0 @@
-$INCLUDE /usr/share/freeradius/dictionary
-$INCLUDE /etc/raddb/dictionary.tnc
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc
deleted file mode 100644
index f295467a9..000000000
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/dictionary.tnc
+++ /dev/null
@@ -1,5 +0,0 @@
-ATTRIBUTE TNC-Status 3001 integer
-
-VALUE TNC-Status Access 0
-VALUE TNC-Status Isolate 1
-VALUE TNC-Status None 2
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf
deleted file mode 100644
index 1143a0473..000000000
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/radiusd.conf
+++ /dev/null
@@ -1,120 +0,0 @@
-# radiusd.conf -- FreeRADIUS server configuration file.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /etc
-localstatedir = /var
-sbindir = ${exec_prefix}/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-# name of the running server. See also the "-n" command-line option.
-name = radiusd
-
-# Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-
-# Should likely be ${localstatedir}/lib/radiusd
-db_dir = ${raddbdir}
-
-# libdir: Where to find the rlm_* modules.
-libdir = ${exec_prefix}/lib
-
-# pidfile: Where to place the PID of the RADIUS server.
-pidfile = ${run_dir}/${name}.pid
-
-# max_request_time: The maximum time (in seconds) to handle a request.
-max_request_time = 30
-
-# cleanup_delay: The time to wait (in seconds) before cleaning up
-cleanup_delay = 5
-
-# max_requests: The maximum number of requests which the server keeps
-max_requests = 1024
-
-# listen: Make the server listen on a particular IP address, and send
-listen {
- type = auth
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# This second "listen" section is for listening on the accounting
-# port, too.
-#
-listen {
- type = acct
- ipaddr = PH_IP_ALICE
- port = 0
-}
-
-# hostname_lookups: Log the names of clients or just their IP addresses
-hostname_lookups = no
-
-# Core dumps are a bad thing. This should only be set to 'yes'
-allow_core_dumps = no
-
-# Regular expressions
-regular_expressions = yes
-extended_expressions = yes
-
-# Logging section. The various "log_*" configuration items
-log {
- destination = files
- file = ${logdir}/radius.log
- syslog_facility = daemon
- stripped_names = no
- auth = yes
- auth_badpass = yes
- auth_goodpass = yes
-}
-
-# The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# Security considerations
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = yes
-}
-
-# PROXY CONFIGURATION
-proxy_requests = yes
-$INCLUDE proxy.conf
-
-# CLIENTS CONFIGURATION
-$INCLUDE clients.conf
-
-# THREAD POOL CONFIGURATION
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-modules {
- $INCLUDE ${confdir}/modules/
- $INCLUDE eap.conf
- $INCLUDE sql.conf
- $INCLUDE sql/mysql/counter.conf
-}
-
-# Instantiation
-instantiate {
- exec
- expr
- expiration
- logintime
-}
-
-# Policies
-$INCLUDE policy.conf
-
-# Include all enabled virtual hosts
-$INCLUDE sites-enabled/
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default b/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default
deleted file mode 100644
index 802fcfd8d..000000000
--- a/testing/tests/tnc/tnccs-11-radius/hosts/alice/etc/raddb/sites-available/default
+++ /dev/null
@@ -1,44 +0,0 @@
-authorize {
- suffix
- eap {
- ok = return
- }
- files
-}
-
-authenticate {
- eap
-}
-
-preacct {
- preprocess
- acct_unique
- suffix
- files
-}
-
-accounting {
- detail
- unix
- radutmp
- attr_filter.accounting_response
-}
-
-session {
- radutmp
-}
-
-post-auth {
- exec
- Post-Auth-Type REJECT {
- attr_filter.access_reject
- }
-}
-
-pre-proxy {
-}
-
-post-proxy {
- eap
-}
-
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/tnc/tnccs-11-radius/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/tnc/tnccs-11-radius/posttest.dat b/testing/tests/tnc/tnccs-11-radius/posttest.dat
index 86bd89dea..a64a9147c 100644
--- a/testing/tests/tnc/tnccs-11-radius/posttest.dat
+++ b/testing/tests/tnc/tnccs-11-radius/posttest.dat
@@ -2,7 +2,7 @@ moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
alice::killall radiusd
-alice::rm /etc/raddb/sites-enabled/inner-tunnel-second
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-11-radius/pretest.dat b/testing/tests/tnc/tnccs-11-radius/pretest.dat
index b5d284278..8f79c776a 100644
--- a/testing/tests/tnc/tnccs-11-radius/pretest.dat
+++ b/testing/tests/tnc/tnccs-11-radius/pretest.dat
@@ -1,8 +1,8 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
-alice::ln -s /etc/raddb/sites-available/inner-tunnel-second /etc/raddb/sites-enabled/inner-tunnel-second
-alice::cat /etc/raddb/sites-enabled/inner-tunnel-second
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second
+alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second
alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd
alice::cat /etc/tnc_config
carol::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-11-radius/test.conf b/testing/tests/tnc/tnccs-11-radius/test.conf
index 2a52df203..f23a19329 100644
--- a/testing/tests/tnc/tnccs-11-radius/test.conf
+++ b/testing/tests/tnc/tnccs-11-radius/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS="alice"
diff --git a/testing/tests/tnc/tnccs-11/evaltest.dat b/testing/tests/tnc/tnccs-11/evaltest.dat
index b6663ea5e..6b7c713ef 100644
--- a/testing/tests/tnc/tnccs-11/evaltest.dat
+++ b/testing/tests/tnc/tnccs-11/evaltest.dat
@@ -1,9 +1,9 @@
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-11/posttest.dat b/testing/tests/tnc/tnccs-11/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/tnc/tnccs-11/posttest.dat
+++ b/testing/tests/tnc/tnccs-11/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-11/pretest.dat b/testing/tests/tnc/tnccs-11/pretest.dat
index dd729cb0b..7bfcf0d07 100644
--- a/testing/tests/tnc/tnccs-11/pretest.dat
+++ b/testing/tests/tnc/tnccs-11/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-11/test.conf b/testing/tests/tnc/tnccs-11/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-11/test.conf
+++ b/testing/tests/tnc/tnccs-11/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-20-block/evaltest.dat b/testing/tests/tnc/tnccs-20-block/evaltest.dat
index 881f442b7..03b576efa 100644
--- a/testing/tests/tnc/tnccs-20-block/evaltest.dat
+++ b/testing/tests/tnc/tnccs-20-block/evaltest.dat
@@ -8,5 +8,5 @@ dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/3
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES
moon:: cat /var/log/daemon.log::EAP method EAP_TTLS failed for peer dave@strongswan.org::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-20-block/posttest.dat b/testing/tests/tnc/tnccs-20-block/posttest.dat
index 50bb7e117..2258e03ff 100644
--- a/testing/tests/tnc/tnccs-20-block/posttest.dat
+++ b/testing/tests/tnc/tnccs-20-block/posttest.dat
@@ -1,7 +1,7 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
dave::/etc/init.d/apache2 stop 2> /dev/null
diff --git a/testing/tests/tnc/tnccs-20-block/pretest.dat b/testing/tests/tnc/tnccs-20-block/pretest.dat
index 7b0a42fcd..f5b3b2e8c 100644
--- a/testing/tests/tnc/tnccs-20-block/pretest.dat
+++ b/testing/tests/tnc/tnccs-20-block/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
dave::/etc/init.d/apache2 start 2> /dev/null
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-20-block/test.conf b/testing/tests/tnc/tnccs-20-block/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-20-block/test.conf
+++ b/testing/tests/tnc/tnccs-20-block/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat b/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat
index 3d84f81e3..bac7294b2 100644
--- a/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat
+++ b/testing/tests/tnc/tnccs-20-client-retry/evaltest.dat
@@ -1,9 +1,9 @@
carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-20-client-retry/posttest.dat b/testing/tests/tnc/tnccs-20-client-retry/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/tnc/tnccs-20-client-retry/posttest.dat
+++ b/testing/tests/tnc/tnccs-20-client-retry/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-20-client-retry/pretest.dat b/testing/tests/tnc/tnccs-20-client-retry/pretest.dat
index 208f9daa9..b2b243ba3 100644
--- a/testing/tests/tnc/tnccs-20-client-retry/pretest.dat
+++ b/testing/tests/tnc/tnccs-20-client-retry/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-20-client-retry/test.conf b/testing/tests/tnc/tnccs-20-client-retry/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-20-client-retry/test.conf
+++ b/testing/tests/tnc/tnccs-20-client-retry/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-20-fhh/evaltest.dat b/testing/tests/tnc/tnccs-20-fhh/evaltest.dat
index 3d84f81e3..bac7294b2 100644
--- a/testing/tests/tnc/tnccs-20-fhh/evaltest.dat
+++ b/testing/tests/tnc/tnccs-20-fhh/evaltest.dat
@@ -1,9 +1,9 @@
carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-20-fhh/posttest.dat b/testing/tests/tnc/tnccs-20-fhh/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/tnc/tnccs-20-fhh/posttest.dat
+++ b/testing/tests/tnc/tnccs-20-fhh/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-20-fhh/pretest.dat b/testing/tests/tnc/tnccs-20-fhh/pretest.dat
index 76ad91f98..72c9b1665 100644
--- a/testing/tests/tnc/tnccs-20-fhh/pretest.dat
+++ b/testing/tests/tnc/tnccs-20-fhh/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-20-fhh/test.conf b/testing/tests/tnc/tnccs-20-fhh/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-20-fhh/test.conf
+++ b/testing/tests/tnc/tnccs-20-fhh/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-20-os/description.txt b/testing/tests/tnc/tnccs-20-os/description.txt
new file mode 100644
index 000000000..b5d12fc8c
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/description.txt
@@ -0,0 +1,23 @@
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
+using EAP-TTLS authentication only with the gateway presenting a server certificate and
+the clients doing EAP-MD5 password-based authentication.
+In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
+state of <b>carol</b>'s and <b>dave</b>'s operating system via the <b>TNCCS 2.0 </b>
+client-server interface compliant with <b>RFC 5793 PB-TNC</b>. The OS IMC and OS IMV pair
+is using the <b>IF-M 1.0</b> measurement protocol defined by <b>RFC 5792 PA-TNC</b> to
+exchange PA-TNC attributes.
+<p>
+<b>carol</b> sends information on her operating system consisting of the PA-TNC attributes
+<em>Product Information</em>, <em>String Version</em>, <em>Numeric Version</em>,
+<em>Operational Status</em>, <em>Forwarding Enabled</em>, and
+<em>Factory Default Password Enabled</em> up-front, whereas <b>dave</b> must be prompted
+by the IMV to do so via an <em>Attribute Request</em> PA-TNC attribute. <b>carol</b> is
+then prompted to send a list of installed packages using the <em>Installed Packages</em>
+PA-TNC attribute whereas <b>dave</b>'s "Windows 1.2.3" operating system is not supported
+and thus <b>dave</b> receives a <em>Remediation Instructions</em> PA-TNC attribute.
+<p>
+<b>carol</b> passes the health test and <b>dave</b> fails. Based on these assessments
+which are communicated to the IMCs using the <em>Assessment Result</em> PA-TNC attribute,
+the clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate"
+subnets, respectively.
+</p>
diff --git a/testing/tests/tnc/tnccs-20-os/evaltest.dat b/testing/tests/tnc/tnccs-20-os/evaltest.dat
new file mode 100644
index 000000000..3c13e5ffa
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/evaltest.dat
@@ -0,0 +1,19 @@
+carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
+carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
+dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
+dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
+dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
+moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
+moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES
+moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
+moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
+moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
+moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.conf b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.conf
new file mode 100644
index 000000000..e2bf349d9
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+ charondebug="tnc 3, imc 3"
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+ keyexchange=ikev2
+
+conn home
+ left=PH_IP_CAROL
+ leftid=carol@strongswan.org
+ leftauth=eap
+ leftfirewall=yes
+ right=PH_IP_MOON
+ rightid=@moon.strongswan.org
+ rightauth=any
+ rightsendcert=never
+ rightsubnet=10.1.0.0/16
+ auto=add
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.secrets b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..74942afda
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+carol@strongswan.org : EAP "Ar3etTnp"
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/strongswan.conf
new file mode 100644
index 000000000..34941e52c
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/strongswan.conf
@@ -0,0 +1,19 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
+ multiple_authentication=no
+ plugins {
+ eap-tnc {
+ protocol = tnccs-2.0
+ }
+ }
+}
+
+libimcv {
+ plugins {
+ imc-os {
+ push_info = yes
+ }
+ }
+}
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/tnc_config b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/tnc_config
new file mode 100644
index 000000000..25c28442f
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/carol/etc/tnc_config
@@ -0,0 +1,3 @@
+#IMC configuration file for strongSwan client
+
+IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.conf b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.conf
new file mode 100644
index 000000000..77446cbae
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+ charondebug="tnc 3, imc 3"
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+ keyexchange=ikev2
+
+conn home
+ left=PH_IP_DAVE
+ leftid=dave@strongswan.org
+ leftauth=eap
+ leftfirewall=yes
+ right=PH_IP_MOON
+ rightid=@moon.strongswan.org
+ rightauth=any
+ rightsendcert=never
+ rightsubnet=10.1.0.0/16
+ auto=add
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.secrets b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.secrets
new file mode 100644
index 000000000..5496df7ad
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+dave@strongswan.org : EAP "W7R0g3do"
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/strongswan.conf
new file mode 100644
index 000000000..149f51d65
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/strongswan.conf
@@ -0,0 +1,26 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
+ multiple_authentication=no
+ plugins {
+ eap-tnc {
+ protocol = tnccs-2.0
+ }
+ tnc-imc {
+ preferred_language = de
+ }
+ }
+}
+
+libimcv {
+ os_info {
+ name = Windows
+ version = 1.2.3
+ }
+ plugins {
+ imc-os {
+ push_info = no
+ }
+ }
+}
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/tnc_config b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/tnc_config
new file mode 100644
index 000000000..25c28442f
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/dave/etc/tnc_config
@@ -0,0 +1,3 @@
+#IMC configuration file for strongSwan client
+
+IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.conf b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.conf
new file mode 100644
index 000000000..e21ef0d14
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,34 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+ charondebug="tnc 3, imv 3"
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+ keyexchange=ikev2
+
+conn rw-allow
+ rightgroups=allow
+ leftsubnet=10.1.0.0/28
+ also=rw-eap
+ auto=add
+
+conn rw-isolate
+ rightgroups=isolate
+ leftsubnet=10.1.0.16/28
+ also=rw-eap
+ auto=add
+
+conn rw-eap
+ left=PH_IP_MOON
+ leftcert=moonCert.pem
+ leftid=@moon.strongswan.org
+ leftauth=eap-ttls
+ leftfirewall=yes
+ rightauth=eap-ttls
+ rightid=*@strongswan.org
+ rightsendcert=never
+ right=%any
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.secrets b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..2e277ccb0
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,6 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA moonKey.pem
+
+carol@strongswan.org : EAP "Ar3etTnp"
+dave@strongswan.org : EAP "W7R0g3do"
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/strongswan.conf b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/strongswan.conf
new file mode 100644
index 000000000..b11617cb2
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/strongswan.conf
@@ -0,0 +1,24 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac stroke kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
+ multiple_authentication=no
+ plugins {
+ eap-ttls {
+ phase2_method = md5
+ phase2_piggyback = yes
+ phase2_tnc = yes
+ }
+ eap-tnc {
+ protocol = tnccs-2.0
+ }
+ }
+}
+
+libimcv {
+ plugins {
+ imv-os {
+ request_installed_packages = yes
+ }
+ }
+}
diff --git a/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/tnc_config b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/tnc_config
new file mode 100644
index 000000000..b75a9cb1e
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/hosts/moon/etc/tnc_config
@@ -0,0 +1,3 @@
+#IMV configuration file for strongSwan client
+
+IMV "OS" /usr/local/lib/ipsec/imcvs/imv-os.so
diff --git a/testing/tests/tnc/tnccs-20-os/posttest.dat b/testing/tests/tnc/tnccs-20-os/posttest.dat
new file mode 100644
index 000000000..74b902c69
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/posttest.dat
@@ -0,0 +1,7 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
+carol::echo 1 > /proc/sys/net/ipv4/ip_forward
diff --git a/testing/tests/tnc/tnccs-20-os/pretest.dat b/testing/tests/tnc/tnccs-20-os/pretest.dat
new file mode 100644
index 000000000..8169afab2
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/pretest.dat
@@ -0,0 +1,14 @@
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
+carol::echo 0 > /proc/sys/net/ipv4/ip_forward
+moon::cat /etc/tnc_config
+carol::cat /etc/tnc_config
+dave::cat /etc/tnc_config
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
+dave::sleep 1
diff --git a/testing/tests/tnc/tnccs-20-os/test.conf b/testing/tests/tnc/tnccs-20-os/test.conf
new file mode 100644
index 000000000..a8a05af19
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-os/test.conf
@@ -0,0 +1,26 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="alice venus moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-c-w-d.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
+
+# Guest instances on which FreeRadius is started
+#
+RADIUSHOSTS=
+
diff --git a/testing/tests/tnc/tnccs-20-pdp/evaltest.dat b/testing/tests/tnc/tnccs-20-pdp/evaltest.dat
index 83739b70a..e969774c5 100644
--- a/testing/tests/tnc/tnccs-20-pdp/evaltest.dat
+++ b/testing/tests/tnc/tnccs-20-pdp/evaltest.dat
@@ -1,10 +1,10 @@
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES
carol::cat /var/log/daemon.log::PB-TNC access recommendation is .*Access Allowed::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA signature successful::YES
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is .*Quarantined::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES
moon:: cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with EAP successful::YES
@@ -12,7 +12,7 @@ moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2>/dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2>/dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables
deleted file mode 100755
index 56587b2e8..000000000
--- a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/init.d/iptables
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-opts="start stop reload"
-
-depend() {
- before net
- need logger
-}
-
-start() {
- ebegin "Starting firewall"
-
- # enable IP forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
-
- # default policy is DROP
- /sbin/iptables -P INPUT DROP
- /sbin/iptables -P OUTPUT DROP
- /sbin/iptables -P FORWARD DROP
-
- # allow esp
- iptables -A INPUT -i eth0 -p 50 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
-
- # allow IKE
- iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
-
- # allow MobIKE
- iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
- iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
-
- # allow crl fetch from winnetou
- iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
- iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
-
- # allow RADIUS protocol with alice
- iptables -A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
- iptables -A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
-
- # allow ssh
- iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
-
- eend $?
-}
-
-stop() {
- ebegin "Stopping firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
-
- if [ $a == nat ]; then
- /sbin/iptables -t nat -P PREROUTING ACCEPT
- /sbin/iptables -t nat -P POSTROUTING ACCEPT
- /sbin/iptables -t nat -P OUTPUT ACCEPT
- elif [ $a == mangle ]; then
- /sbin/iptables -t mangle -P PREROUTING ACCEPT
- /sbin/iptables -t mangle -P INPUT ACCEPT
- /sbin/iptables -t mangle -P FORWARD ACCEPT
- /sbin/iptables -t mangle -P OUTPUT ACCEPT
- /sbin/iptables -t mangle -P POSTROUTING ACCEPT
- elif [ $a == filter ]; then
- /sbin/iptables -t filter -P INPUT ACCEPT
- /sbin/iptables -t filter -P FORWARD ACCEPT
- /sbin/iptables -t filter -P OUTPUT ACCEPT
- fi
- done
- eend $?
-}
-
-reload() {
- ebegin "Flushing firewall"
- for a in `cat /proc/net/ip_tables_names`; do
- /sbin/iptables -F -t $a
- /sbin/iptables -X -t $a
- done;
- eend $?
- start
-}
-
diff --git a/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules
new file mode 100644
index 000000000..1eb755354
--- /dev/null
+++ b/testing/tests/tnc/tnccs-20-pdp/hosts/moon/etc/iptables.rules
@@ -0,0 +1,32 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow esp
+-A INPUT -i eth0 -p 50 -j ACCEPT
+-A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+# allow IKE
+-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+# allow RADIUS protocol with alice
+-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
+-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
+
+COMMIT
diff --git a/testing/tests/tnc/tnccs-20-pdp/posttest.dat b/testing/tests/tnc/tnccs-20-pdp/posttest.dat
index 16218f385..e7eecd5f4 100644
--- a/testing/tests/tnc/tnccs-20-pdp/posttest.dat
+++ b/testing/tests/tnc/tnccs-20-pdp/posttest.dat
@@ -2,6 +2,6 @@ moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
alice::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-20-pdp/pretest.dat b/testing/tests/tnc/tnccs-20-pdp/pretest.dat
index 9b9d6b699..32ed4d854 100644
--- a/testing/tests/tnc/tnccs-20-pdp/pretest.dat
+++ b/testing/tests/tnc/tnccs-20-pdp/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
alice::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-20-pdp/test.conf b/testing/tests/tnc/tnccs-20-pdp/test.conf
index 400628531..c4ca1a19f 100644
--- a/testing/tests/tnc/tnccs-20-pdp/test.conf
+++ b/testing/tests/tnc/tnccs-20-pdp/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave alice"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat b/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat
index 3d84f81e3..bac7294b2 100644
--- a/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat
+++ b/testing/tests/tnc/tnccs-20-server-retry/evaltest.dat
@@ -1,9 +1,9 @@
carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-20-server-retry/posttest.dat b/testing/tests/tnc/tnccs-20-server-retry/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/tnc/tnccs-20-server-retry/posttest.dat
+++ b/testing/tests/tnc/tnccs-20-server-retry/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-20-server-retry/pretest.dat b/testing/tests/tnc/tnccs-20-server-retry/pretest.dat
index 208f9daa9..b2b243ba3 100644
--- a/testing/tests/tnc/tnccs-20-server-retry/pretest.dat
+++ b/testing/tests/tnc/tnccs-20-server-retry/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-20-server-retry/test.conf b/testing/tests/tnc/tnccs-20-server-retry/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-20-server-retry/test.conf
+++ b/testing/tests/tnc/tnccs-20-server-retry/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-20-tls/evaltest.dat b/testing/tests/tnc/tnccs-20-tls/evaltest.dat
index 3d84f81e3..bac7294b2 100644
--- a/testing/tests/tnc/tnccs-20-tls/evaltest.dat
+++ b/testing/tests/tnc/tnccs-20-tls/evaltest.dat
@@ -1,9 +1,9 @@
carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-20-tls/posttest.dat b/testing/tests/tnc/tnccs-20-tls/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/tnc/tnccs-20-tls/posttest.dat
+++ b/testing/tests/tnc/tnccs-20-tls/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-20-tls/pretest.dat b/testing/tests/tnc/tnccs-20-tls/pretest.dat
index c332f131b..cac1cfafc 100644
--- a/testing/tests/tnc/tnccs-20-tls/pretest.dat
+++ b/testing/tests/tnc/tnccs-20-tls/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-20-tls/test.conf b/testing/tests/tnc/tnccs-20-tls/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-20-tls/test.conf
+++ b/testing/tests/tnc/tnccs-20-tls/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-20/evaltest.dat b/testing/tests/tnc/tnccs-20/evaltest.dat
index 3d84f81e3..bac7294b2 100644
--- a/testing/tests/tnc/tnccs-20/evaltest.dat
+++ b/testing/tests/tnc/tnccs-20/evaltest.dat
@@ -1,9 +1,9 @@
carol::cat /var/log/daemon.log::PB-TNC access recommendation is 'Access Allowed'::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
@@ -12,8 +12,8 @@ moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP successful::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf b/testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf
index a483d6df8..e2bf349d9 100644
--- a/testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/tnc/tnccs-20/hosts/carol/etc/ipsec.conf
@@ -1,7 +1,7 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
- charondebug="tnc 3, imc 2"
+ charondebug="tnc 3, imc 3"
conn %default
ikelifetime=60m
diff --git a/testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf b/testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf
index 11378131a..77446cbae 100644
--- a/testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/tnc/tnccs-20/hosts/dave/etc/ipsec.conf
@@ -1,7 +1,7 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
- charondebug="tnc 3, imc 2"
+ charondebug="tnc 3, imc 3"
conn %default
ikelifetime=60m
diff --git a/testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf b/testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf
index b1093d46d..e21ef0d14 100644
--- a/testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/tnc/tnccs-20/hosts/moon/etc/ipsec.conf
@@ -1,7 +1,7 @@
# /etc/ipsec.conf - strongSwan IPsec configuration file
config setup
- charondebug="tnc 3, imv 2"
+ charondebug="tnc 3, imv 3"
conn %default
ikelifetime=60m
diff --git a/testing/tests/tnc/tnccs-20/posttest.dat b/testing/tests/tnc/tnccs-20/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/tnc/tnccs-20/posttest.dat
+++ b/testing/tests/tnc/tnccs-20/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-20/pretest.dat b/testing/tests/tnc/tnccs-20/pretest.dat
index 208f9daa9..b2b243ba3 100644
--- a/testing/tests/tnc/tnccs-20/pretest.dat
+++ b/testing/tests/tnc/tnccs-20/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-20/test.conf b/testing/tests/tnc/tnccs-20/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-20/test.conf
+++ b/testing/tests/tnc/tnccs-20/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=
diff --git a/testing/tests/tnc/tnccs-dynamic/evaltest.dat b/testing/tests/tnc/tnccs-dynamic/evaltest.dat
index 69baaf592..405298381 100644
--- a/testing/tests/tnc/tnccs-dynamic/evaltest.dat
+++ b/testing/tests/tnc/tnccs-dynamic/evaltest.dat
@@ -1,9 +1,9 @@
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
-carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
carol::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.100/32 === 10.1.0.0/28::YES
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is 'Quarantined'::YES
-dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
+dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
dave:: cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon:: cat /var/log/daemon.log::TNCCS 1.1 protocol detected dynamically::YES
@@ -20,8 +20,8 @@ moon:: cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with EAP
moon:: cat /var/log/daemon.log::removed TNCCS Connection ID 2::YES
moon:: ipsec statusall 2> /dev/null::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon:: ipsec statusall 2> /dev/null::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
-carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
-dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_seq=1::NO
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_req=1::YES
+carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_req=1::NO
+dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_req=1::YES
+dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_VENUS: icmp_req=1::NO
diff --git a/testing/tests/tnc/tnccs-dynamic/posttest.dat b/testing/tests/tnc/tnccs-dynamic/posttest.dat
index 7cebd7f25..1865a1c60 100644
--- a/testing/tests/tnc/tnccs-dynamic/posttest.dat
+++ b/testing/tests/tnc/tnccs-dynamic/posttest.dat
@@ -1,6 +1,6 @@
moon::ipsec stop
carol::ipsec stop
dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables-restore < /etc/iptables.flush
+carol::iptables-restore < /etc/iptables.flush
+dave::iptables-restore < /etc/iptables.flush
diff --git a/testing/tests/tnc/tnccs-dynamic/pretest.dat b/testing/tests/tnc/tnccs-dynamic/pretest.dat
index a7a3bf412..60775a11e 100644
--- a/testing/tests/tnc/tnccs-dynamic/pretest.dat
+++ b/testing/tests/tnc/tnccs-dynamic/pretest.dat
@@ -1,6 +1,6 @@
-moon::/etc/init.d/iptables start 2> /dev/null
-carol::/etc/init.d/iptables start 2> /dev/null
-dave::/etc/init.d/iptables start 2> /dev/null
+moon::iptables-restore < /etc/iptables.rules
+carol::iptables-restore < /etc/iptables.rules
+dave::iptables-restore < /etc/iptables.rules
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
diff --git a/testing/tests/tnc/tnccs-dynamic/test.conf b/testing/tests/tnc/tnccs-dynamic/test.conf
index e28b8259b..a8a05af19 100644
--- a/testing/tests/tnc/tnccs-dynamic/test.conf
+++ b/testing/tests/tnc/tnccs-dynamic/test.conf
@@ -1,26 +1,26 @@
#!/bin/bash
#
# This configuration file provides information on the
-# UML instances used for this test
+# guest instances used for this test
-# All UML instances that are required for this test
+# All guest instances that are required for this test
#
-UMLHOSTS="alice venus moon carol winnetou dave"
+VIRTHOSTS="alice venus moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-v-m-c-w-d.png"
-# UML instances on which tcpdump is to be started
+# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
-# UML instances on which IPsec is started
+# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
-# UML instances on which FreeRadius is started
+# Guest instances on which FreeRadius is started
#
RADIUSHOSTS=