summaryrefslogtreecommitdiff
path: root/testing/hosts/carol
diff options
context:
space:
mode:
Diffstat (limited to 'testing/hosts/carol')
-rw-r--r--testing/hosts/carol/etc/conf.d/hostname1
-rw-r--r--testing/hosts/carol/etc/conf.d/net10
-rwxr-xr-xtesting/hosts/carol/etc/init.d/iptables73
-rwxr-xr-xtesting/hosts/carol/etc/init.d/net.eth0314
-rwxr-xr-xtesting/hosts/carol/etc/ipsec.conf29
-rw-r--r--testing/hosts/carol/etc/ipsec.d/cacerts/strongswanCert.pem22
-rw-r--r--testing/hosts/carol/etc/ipsec.d/certs/carolCert.pem25
-rw-r--r--testing/hosts/carol/etc/ipsec.d/private/carolKey.pem27
-rw-r--r--testing/hosts/carol/etc/ipsec.secrets7
-rwxr-xr-xtesting/hosts/carol/etc/runlevels/default/net.eth0314
10 files changed, 822 insertions, 0 deletions
diff --git a/testing/hosts/carol/etc/conf.d/hostname b/testing/hosts/carol/etc/conf.d/hostname
new file mode 100644
index 000000000..d5101b924
--- /dev/null
+++ b/testing/hosts/carol/etc/conf.d/hostname
@@ -0,0 +1 @@
+HOSTNAME=carol
diff --git a/testing/hosts/carol/etc/conf.d/net b/testing/hosts/carol/etc/conf.d/net
new file mode 100644
index 000000000..39470ad14
--- /dev/null
+++ b/testing/hosts/carol/etc/conf.d/net
@@ -0,0 +1,10 @@
+# /etc/conf.d/net:
+
+# This is basically the ifconfig argument without the ifconfig $iface
+#
+iface_lo="127.0.0.1 netmask 255.0.0.0"
+iface_eth0="PH_IP_CAROL broadcast 192.168.0.255 netmask 255.255.255.0"
+
+# For setting the default gateway
+#
+gateway="eth0/192.168.0.254"
diff --git a/testing/hosts/carol/etc/init.d/iptables b/testing/hosts/carol/etc/init.d/iptables
new file mode 100755
index 000000000..cd7ba23ff
--- /dev/null
+++ b/testing/hosts/carol/etc/init.d/iptables
@@ -0,0 +1,73 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+ before net
+ need logger
+}
+
+start() {
+ ebegin "Starting firewall"
+
+ # default policy is DROP
+ /sbin/iptables -P INPUT DROP
+ /sbin/iptables -P OUTPUT DROP
+ /sbin/iptables -P FORWARD DROP
+
+ # allow esp
+ iptables -A INPUT -i eth0 -p 50 -j ACCEPT
+ iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+ # allow IKE
+ iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+ iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+ # allow crl fetch from winnetou
+ iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+ iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+ # allow ssh
+ iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+ iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+ eend $?
+}
+
+stop() {
+ ebegin "Stopping firewall"
+ for a in `cat /proc/net/ip_tables_names`; do
+ /sbin/iptables -F -t $a
+ /sbin/iptables -X -t $a
+
+ if [ $a == nat ]; then
+ /sbin/iptables -t nat -P PREROUTING ACCEPT
+ /sbin/iptables -t nat -P POSTROUTING ACCEPT
+ /sbin/iptables -t nat -P OUTPUT ACCEPT
+ elif [ $a == mangle ]; then
+ /sbin/iptables -t mangle -P PREROUTING ACCEPT
+ /sbin/iptables -t mangle -P INPUT ACCEPT
+ /sbin/iptables -t mangle -P FORWARD ACCEPT
+ /sbin/iptables -t mangle -P OUTPUT ACCEPT
+ /sbin/iptables -t mangle -P POSTROUTING ACCEPT
+ elif [ $a == filter ]; then
+ /sbin/iptables -t filter -P INPUT ACCEPT
+ /sbin/iptables -t filter -P FORWARD ACCEPT
+ /sbin/iptables -t filter -P OUTPUT ACCEPT
+ fi
+ done
+ eend $?
+}
+
+reload() {
+ ebegin "Flushing firewall"
+ for a in `cat /proc/net/ip_tables_names`; do
+ /sbin/iptables -F -t $a
+ /sbin/iptables -X -t $a
+ done;
+ eend $?
+ start
+}
+
diff --git a/testing/hosts/carol/etc/init.d/net.eth0 b/testing/hosts/carol/etc/init.d/net.eth0
new file mode 100755
index 000000000..fa1200242
--- /dev/null
+++ b/testing/hosts/carol/etc/init.d/net.eth0
@@ -0,0 +1,314 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License v2
+
+#NB: Config is in /etc/conf.d/net
+
+if [[ -n $NET_DEBUG ]]; then
+ set -x
+ devnull=/dev/stderr
+else
+ devnull=/dev/null
+fi
+
+# For pcmcia users. note that pcmcia must be added to the same
+# runlevel as the net.* script that needs it.
+depend() {
+ use hotplug pcmcia
+}
+
+checkconfig() {
+ if [[ -z "${ifconfig_IFACE}" ]]; then
+ eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
+ eerror "(or \$iface_$IFACE for old-style configuration)"
+ return 1
+ fi
+ if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
+ eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
+ return 1
+ fi
+}
+
+# Fix bug 50039 (init.d/net.eth0 localization)
+# Some other commands in this script might need to be wrapped, but
+# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
+# according to locale(7)
+ifconfig() {
+ LC_ALL=C /sbin/ifconfig "$@"
+}
+
+# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
+# The following variables are set, which should be declared local by
+# the calling routine.
+# status_IFACE (up or '')
+# vlans_IFACE (space-separated list)
+# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
+# dhcpcd_IFACE (command-line args for dhcpcd)
+# routes_IFACE (array of route lines)
+# inet6_IFACE (array of inet6 lines)
+# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
+setup_vars() {
+ local i iface="${1//\./_}"
+
+ status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
+ eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
+ eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
+ eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
+ eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
+ eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
+ eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
+
+ # BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
+ # if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
+ eval local iface_IFACE=\"\$\{iface_$iface\}\"
+ if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
+ # Make sure these get evaluated as arrays
+ local -a aliases broadcasts netmasks
+
+ # Start with the primary interface
+ ifconfig_IFACE=( "${iface_IFACE}" )
+
+ # ..then add aliases
+ eval aliases=( \$\{alias_$iface\} )
+ eval broadcasts=( \$\{broadcast_$iface\} )
+ eval netmasks=( \$\{netmask_$iface\} )
+ for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
+ ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
+ done
+ fi
+
+ # BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
+ if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
+ inet6_IFACE=( ${inet6_IFACE} )
+ fi
+}
+
+iface_start() {
+ local IFACE=${1} i x retval
+ checkconfig || return 1
+
+ if [[ ${ifconfig_IFACE} != dhcp ]]; then
+ # Show the address, but catch if this interface will be inet6 only
+ i=${ifconfig_IFACE%% *}
+ if [[ ${i} == *.*.*.* ]]; then
+ ebegin "Bringing ${IFACE} up (${i})"
+ else
+ ebegin "Bringing ${IFACE} up"
+ fi
+ # ifconfig does not always return failure ..
+ ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
+ ifconfig ${IFACE} up &>${devnull}
+ eend $? || return $?
+ else
+ # Check that eth0 was not brought up by the kernel ...
+ if [[ ${status_IFACE} == up ]]; then
+ einfo "Keeping kernel configuration for ${IFACE}"
+ else
+ ebegin "Bringing ${IFACE} up via DHCP"
+ /sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
+ retval=$?
+ eend $retval
+ if [[ $retval == 0 ]]; then
+ # DHCP succeeded, show address retrieved
+ i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
+ cut -d: -f2)
+ [[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
+ elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
+ # DHCP failed, try fallback.
+ # Show the address, but catch if this interface will be inet6 only
+ i=${ifconfig_fallback_IFACE%% *}
+ if [[ ${i} == *.*.*.* ]]; then
+ ebegin "Using fallback configuration (${i}) for ${IFACE}"
+ else
+ ebegin "Using fallback configuration for ${IFACE}"
+ fi
+ ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
+ ifconfig ${IFACE} up &>${devnull}
+ eend $? || return $?
+ else
+ return $retval
+ fi
+ fi
+ fi
+
+ if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
+ einfo " Adding aliases"
+ for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
+ ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
+ ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
+ eend $?
+ done
+ fi
+
+ if [[ -n ${inet6_IFACE} ]]; then
+ einfo " Adding inet6 addresses"
+ for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
+ ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
+ ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
+ eend $?
+ done
+ fi
+
+ # Set static routes
+ if [[ -n ${routes_IFACE} ]]; then
+ einfo " Adding routes"
+ for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
+ ebegin " ${routes_IFACE[i]}"
+ /sbin/route add ${routes_IFACE[i]}
+ eend $?
+ done
+ fi
+
+ # Set default route if applicable to this interface
+ if [[ ${gateway} == ${IFACE}/* ]]; then
+ local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
+ local gw=${gateway#*/}
+ if [[ ${ogw} != ${gw} ]]; then
+ ebegin " Setting default gateway ($gw)"
+
+ # First delete any existing route if it was setup by kernel...
+ /sbin/route del default dev ${IFACE} &>${devnull}
+
+ # Second delete old gateway if it was set...
+ /sbin/route del default gw ${ogw} &>${devnull}
+
+ # Third add our new default gateway
+ /sbin/route add default gw ${gw} >${devnull}
+ eend $? || {
+ true # need to have some command in here
+ # Note: This originally called stop, which is obviously
+ # wrong since it's calling with a local version of IFACE.
+ # The below code works correctly to abort configuration of
+ # the interface, but is commented because we're assuming
+ # that default route failure should not cause the interface
+ # to be unconfigured.
+ #local error=$?
+ #ewarn "Aborting configuration of ${IFACE}"
+ #iface_stop ${IFACE}
+ #return ${error}
+ }
+ fi
+ fi
+
+ # Enabling rp_filter causes wacky packets to be auto-dropped by
+ # the kernel. Note that we only do this if it is not set via
+ # /etc/sysctl.conf ...
+ if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
+ -z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
+ echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
+ fi
+}
+
+# iface_stop: bring down an interface. Don't trust information in
+# /etc/conf.d/net since the configuration might have changed since
+# iface_start ran. Instead query for current configuration and bring
+# down the interface.
+iface_stop() {
+ local IFACE=${1} i x aliases inet6 count
+
+ # Try to do a simple down (no aliases, no inet6, no dhcp)
+ aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
+ inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
+ if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
+ ebegin "Bringing ${IFACE} down"
+ ifconfig ${IFACE} down &>/dev/null
+ eend 0
+ return 0
+ fi
+
+ einfo "Bringing ${IFACE} down"
+
+ # Stop aliases before primary interface.
+ # Note this must be done in reverse order, since ifconfig eth0:1
+ # will remove eth0:2, etc. It might be sufficient to simply remove
+ # the base interface but we're being safe here.
+ for i in ${aliases} ${IFACE}; do
+
+ # Delete all the inet6 addresses for this interface
+ inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
+ if [[ -n ${inet6} ]]; then
+ einfo " Removing inet6 addresses"
+ for x in ${inet6}; do
+ ebegin " ${IFACE} inet6 del ${x}"
+ ifconfig ${i} inet6 del ${x}
+ eend $?
+ done
+ fi
+
+ # Stop DHCP (should be N/A for aliases)
+ # Don't trust current configuration... investigate ourselves
+ if /sbin/dhcpcd -z ${i} &>${devnull}; then
+ ebegin " Releasing DHCP lease for ${IFACE}"
+ for ((count = 0; count < 9; count = count + 1)); do
+ /sbin/dhcpcd -z ${i} &>${devnull} || break
+ sleep 1
+ done
+ [[ ${count} -lt 9 ]]
+ eend $? "Timed out"
+ fi
+ ebegin " Stopping ${i}"
+ ifconfig ${i} down &>${devnull}
+ eend 0
+ done
+
+ return 0
+}
+
+start() {
+ # These variables are set by setup_vars
+ local status_IFACE vlans_IFACE dhcpcd_IFACE
+ local -a ifconfig_IFACE routes_IFACE inet6_IFACE
+
+ # Call user-defined preup function if it exists
+ if [[ $(type -t preup) == function ]]; then
+ einfo "Running preup function"
+ preup ${IFACE} || {
+ eerror "preup ${IFACE} failed"
+ return 1
+ }
+ fi
+
+ # Start the primary interface and aliases
+ setup_vars ${IFACE}
+ iface_start ${IFACE} || return 1
+
+ # Start vlans
+ local vlan
+ for vlan in ${vlans_IFACE}; do
+ /sbin/vconfig add ${IFACE} ${vlan} >${devnull}
+ setup_vars ${IFACE}.${vlan}
+ iface_start ${IFACE}.${vlan}
+ done
+
+ # Call user-defined postup function if it exists
+ if [[ $(type -t postup) == function ]]; then
+ einfo "Running postup function"
+ postup ${IFACE}
+ fi
+}
+
+stop() {
+ # Call user-defined predown function if it exists
+ if [[ $(type -t predown) == function ]]; then
+ einfo "Running predown function"
+ predown ${IFACE}
+ fi
+
+ # Don't depend on setup_vars since configuration might have changed.
+ # Investigate current configuration instead.
+ local vlan
+ for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
+ iface_stop ${vlan}
+ /sbin/vconfig rem ${vlan} >${devnull}
+ done
+
+ iface_stop ${IFACE} || return 1 # always succeeds, btw
+
+ # Call user-defined postdown function if it exists
+ if [[ $(type -t postdown) == function ]]; then
+ einfo "Running postdown function"
+ postdown ${IFACE}
+ fi
+}
+
+# vim:ts=4
diff --git a/testing/hosts/carol/etc/ipsec.conf b/testing/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..3228f4e16
--- /dev/null
+++ b/testing/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version 2.0 # conforms to second version of ipsec.conf specification
+
+config setup
+ plutodebug=control
+ crlcheckinterval=180
+ strictcrlpolicy=no
+
+conn %default
+ ikelifetime=60m
+ keylife=20m
+ rekeymargin=3m
+ keyingtries=1
+
+conn home
+ left=PH_IP_CAROL
+ leftnexthop=%direct
+ leftcert=carolCert.pem
+ leftid=carol@strongswan.org
+ leftfirewall=yes
+ right=PH_IP_MOON
+ rightsubnet=10.1.0.0/16
+ rightid=@moon.strongswan.org
+ auto=add
+
+
+
+
diff --git a/testing/hosts/carol/etc/ipsec.d/cacerts/strongswanCert.pem b/testing/hosts/carol/etc/ipsec.d/cacerts/strongswanCert.pem
new file mode 100644
index 000000000..0de3b268d
--- /dev/null
+++ b/testing/hosts/carol/etc/ipsec.d/cacerts/strongswanCert.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
+Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
+X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
+FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
+4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
+7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
+gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
+K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
+DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
+ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
+VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
+Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
+lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
++g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
+UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
+0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
+gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
+-----END CERTIFICATE-----
diff --git a/testing/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/hosts/carol/etc/ipsec.d/certs/carolCert.pem
new file mode 100644
index 000000000..8492fbd45
--- /dev/null
+++ b/testing/hosts/carol/etc/ipsec.d/certs/carolCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
+cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX
+T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl
+vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii
+S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW
+LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM
+YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC
+MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD
+j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
+MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
+EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
+d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
+b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI
+U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM
+2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE
+HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd
+hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG
+C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK
+omBYfxqp
+-----END CERTIFICATE-----
diff --git a/testing/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/hosts/carol/etc/ipsec.d/private/carolKey.pem
new file mode 100644
index 000000000..0522355ce
--- /dev/null
+++ b/testing/hosts/carol/etc/ipsec.d/private/carolKey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAuBuEkgQI4IbI0njTrS6f/AG4noxCO2ErkIAQ+BdP+W9nKehL
+GF+5bmB4MILFB6zp1k95vrAlLgXl8feomgsz5nifXetmUITLIwGRwWW8rRo0Vj4B
+GzSbtqtRfwHs9+L03pYdNiA7hel4EcsmtlDP0BTRXdLStx79ZW5WOKJL9wmGuBKL
+uuXztCjWNg4D0/ToFlAuPR0U1xZasakqn+Fe8EXU5I/1vXmOyAyUIJYsmpeYtUoO
+0qAM8sllHX2YguGBwe9rHEPtytov0ZHhCZYtvSbzigAgjBrD7SelkkxgMwx5h461
+x6kJYKZHL5eaypxa7iu00K7TlbVGxeNhkQoGNwIDAQABAoIBAQCnhwq8H4XAYYWN
+17quJPYZR6uqQfDmvYX5yD8osXXpgNC8Fo92z2wZnxje86+8S0DA7bLXrMs4NM/H
+vVcjTTxd5LcHrHN+o0eBRCVQeXYVgfnL3EH/coCa2Qugaa0q589wV+Ke5Pek5AyJ
+DHXegmyHaNoW6Qcq8L0dtigpAq3jTLG5w/3QCo8DMDKOGNR3AJrFpDlS/gW3JXuL
+Tn+PUojoWO9W6joDGYDTi4eeYyfZSajzwZvzecEpez3vwKN0pupvHA6BJCR8Mzkq
+5EYIH0hvWLtBy8uiWRXTfu/ggoQI9/Z5hBWIQk71m23uMIBbkm+oDn/1fLSBcWfK
+cr9RyM+RAoGBANpWewy7xCbkRV/90bgBNkTZ9HeFsFsWOgFVyB1XwM2E/nOqdRJc
+rxFt5Qt63DaXB+2REn231EIrsIz/Xd+R9KDl+yZOCY/m/mL4oquTPurEGJPzZdgW
+X3kUOFW1pbfcMcmzSp1FPufI17JPiePtUb/q3C4RAjCKlnskHftEyK1pAoGBANfd
+eEN8UzoV/R3WsGNDNOecMdIVAX9aiGnkLLraP7CRZ1heCH5y+RV1RB98yppkJG31
+fw5F8a6GoomkMHWGqhzDzQacZQV8w7C6rDY0Bk5TF5vemvJTGlrydwodfMvcJj8Y
+KZrS7A0iS3GAAmM6VGr3THyscszfJTq0NwE3v4KfAoGAY7L1wVzENxYpb6nRZ/p1
+s37rGODdJNrDZfSrympVygMexeZiSx4zevv5iQJzKCJTJnIGRY35yLV2iwvY68wU
+LpyV0Gn2B9Xs93idn0c/hahBqN2N9dxRgFJxXwHxSEGuInJScfo6vVCC3hNf3cpy
+d/Zg0FBH9a5zBIv7fM9t63ECgYAosrSt5I68cNDcA1IWJOGgmS47cYJqxGLbtA1K
+3UMMwx08592qGXsktIs3dIuuOBs2MAbYZg9+3Btg3/fS8KS576CEEpBpTHCIrWky
+fvSBZ+EXngyQi2J4qyYOXijdNpBvbNrLOeEPSNv4di39D05DLITbLJgoUBnwy3Fj
+ZWNR+QKBgEKn19f5QWs/O1DPWBXfvCSc01cuSUx20a6Z3B6Lxj+7MuXBjVxPkGge
+kEaZnNzwgm+QQ1C51nIn9gY4LZx7OxMy0idEss76aRq4Lb7I6XakBrCQLQ9IiTkv
+gNOeJYGsQv7tkIWWRlBIXjSBGwT6HzTEfN5cvdHSDzARGFGjwYfK
+-----END RSA PRIVATE KEY-----
diff --git a/testing/hosts/carol/etc/ipsec.secrets b/testing/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..797f18a01
--- /dev/null
+++ b/testing/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,7 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA carolKey.pem
+
+
+
+
diff --git a/testing/hosts/carol/etc/runlevels/default/net.eth0 b/testing/hosts/carol/etc/runlevels/default/net.eth0
new file mode 100755
index 000000000..fa1200242
--- /dev/null
+++ b/testing/hosts/carol/etc/runlevels/default/net.eth0
@@ -0,0 +1,314 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License v2
+
+#NB: Config is in /etc/conf.d/net
+
+if [[ -n $NET_DEBUG ]]; then
+ set -x
+ devnull=/dev/stderr
+else
+ devnull=/dev/null
+fi
+
+# For pcmcia users. note that pcmcia must be added to the same
+# runlevel as the net.* script that needs it.
+depend() {
+ use hotplug pcmcia
+}
+
+checkconfig() {
+ if [[ -z "${ifconfig_IFACE}" ]]; then
+ eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
+ eerror "(or \$iface_$IFACE for old-style configuration)"
+ return 1
+ fi
+ if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
+ eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
+ return 1
+ fi
+}
+
+# Fix bug 50039 (init.d/net.eth0 localization)
+# Some other commands in this script might need to be wrapped, but
+# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
+# according to locale(7)
+ifconfig() {
+ LC_ALL=C /sbin/ifconfig "$@"
+}
+
+# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
+# The following variables are set, which should be declared local by
+# the calling routine.
+# status_IFACE (up or '')
+# vlans_IFACE (space-separated list)
+# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
+# dhcpcd_IFACE (command-line args for dhcpcd)
+# routes_IFACE (array of route lines)
+# inet6_IFACE (array of inet6 lines)
+# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
+setup_vars() {
+ local i iface="${1//\./_}"
+
+ status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
+ eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
+ eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
+ eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
+ eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
+ eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
+ eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
+
+ # BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
+ # if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
+ eval local iface_IFACE=\"\$\{iface_$iface\}\"
+ if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
+ # Make sure these get evaluated as arrays
+ local -a aliases broadcasts netmasks
+
+ # Start with the primary interface
+ ifconfig_IFACE=( "${iface_IFACE}" )
+
+ # ..then add aliases
+ eval aliases=( \$\{alias_$iface\} )
+ eval broadcasts=( \$\{broadcast_$iface\} )
+ eval netmasks=( \$\{netmask_$iface\} )
+ for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
+ ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
+ done
+ fi
+
+ # BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
+ if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
+ inet6_IFACE=( ${inet6_IFACE} )
+ fi
+}
+
+iface_start() {
+ local IFACE=${1} i x retval
+ checkconfig || return 1
+
+ if [[ ${ifconfig_IFACE} != dhcp ]]; then
+ # Show the address, but catch if this interface will be inet6 only
+ i=${ifconfig_IFACE%% *}
+ if [[ ${i} == *.*.*.* ]]; then
+ ebegin "Bringing ${IFACE} up (${i})"
+ else
+ ebegin "Bringing ${IFACE} up"
+ fi
+ # ifconfig does not always return failure ..
+ ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
+ ifconfig ${IFACE} up &>${devnull}
+ eend $? || return $?
+ else
+ # Check that eth0 was not brought up by the kernel ...
+ if [[ ${status_IFACE} == up ]]; then
+ einfo "Keeping kernel configuration for ${IFACE}"
+ else
+ ebegin "Bringing ${IFACE} up via DHCP"
+ /sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
+ retval=$?
+ eend $retval
+ if [[ $retval == 0 ]]; then
+ # DHCP succeeded, show address retrieved
+ i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
+ cut -d: -f2)
+ [[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
+ elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
+ # DHCP failed, try fallback.
+ # Show the address, but catch if this interface will be inet6 only
+ i=${ifconfig_fallback_IFACE%% *}
+ if [[ ${i} == *.*.*.* ]]; then
+ ebegin "Using fallback configuration (${i}) for ${IFACE}"
+ else
+ ebegin "Using fallback configuration for ${IFACE}"
+ fi
+ ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
+ ifconfig ${IFACE} up &>${devnull}
+ eend $? || return $?
+ else
+ return $retval
+ fi
+ fi
+ fi
+
+ if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
+ einfo " Adding aliases"
+ for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
+ ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
+ ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
+ eend $?
+ done
+ fi
+
+ if [[ -n ${inet6_IFACE} ]]; then
+ einfo " Adding inet6 addresses"
+ for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
+ ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
+ ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
+ eend $?
+ done
+ fi
+
+ # Set static routes
+ if [[ -n ${routes_IFACE} ]]; then
+ einfo " Adding routes"
+ for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
+ ebegin " ${routes_IFACE[i]}"
+ /sbin/route add ${routes_IFACE[i]}
+ eend $?
+ done
+ fi
+
+ # Set default route if applicable to this interface
+ if [[ ${gateway} == ${IFACE}/* ]]; then
+ local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
+ local gw=${gateway#*/}
+ if [[ ${ogw} != ${gw} ]]; then
+ ebegin " Setting default gateway ($gw)"
+
+ # First delete any existing route if it was setup by kernel...
+ /sbin/route del default dev ${IFACE} &>${devnull}
+
+ # Second delete old gateway if it was set...
+ /sbin/route del default gw ${ogw} &>${devnull}
+
+ # Third add our new default gateway
+ /sbin/route add default gw ${gw} >${devnull}
+ eend $? || {
+ true # need to have some command in here
+ # Note: This originally called stop, which is obviously
+ # wrong since it's calling with a local version of IFACE.
+ # The below code works correctly to abort configuration of
+ # the interface, but is commented because we're assuming
+ # that default route failure should not cause the interface
+ # to be unconfigured.
+ #local error=$?
+ #ewarn "Aborting configuration of ${IFACE}"
+ #iface_stop ${IFACE}
+ #return ${error}
+ }
+ fi
+ fi
+
+ # Enabling rp_filter causes wacky packets to be auto-dropped by
+ # the kernel. Note that we only do this if it is not set via
+ # /etc/sysctl.conf ...
+ if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
+ -z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
+ echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
+ fi
+}
+
+# iface_stop: bring down an interface. Don't trust information in
+# /etc/conf.d/net since the configuration might have changed since
+# iface_start ran. Instead query for current configuration and bring
+# down the interface.
+iface_stop() {
+ local IFACE=${1} i x aliases inet6 count
+
+ # Try to do a simple down (no aliases, no inet6, no dhcp)
+ aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
+ inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
+ if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
+ ebegin "Bringing ${IFACE} down"
+ ifconfig ${IFACE} down &>/dev/null
+ eend 0
+ return 0
+ fi
+
+ einfo "Bringing ${IFACE} down"
+
+ # Stop aliases before primary interface.
+ # Note this must be done in reverse order, since ifconfig eth0:1
+ # will remove eth0:2, etc. It might be sufficient to simply remove
+ # the base interface but we're being safe here.
+ for i in ${aliases} ${IFACE}; do
+
+ # Delete all the inet6 addresses for this interface
+ inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
+ if [[ -n ${inet6} ]]; then
+ einfo " Removing inet6 addresses"
+ for x in ${inet6}; do
+ ebegin " ${IFACE} inet6 del ${x}"
+ ifconfig ${i} inet6 del ${x}
+ eend $?
+ done
+ fi
+
+ # Stop DHCP (should be N/A for aliases)
+ # Don't trust current configuration... investigate ourselves
+ if /sbin/dhcpcd -z ${i} &>${devnull}; then
+ ebegin " Releasing DHCP lease for ${IFACE}"
+ for ((count = 0; count < 9; count = count + 1)); do
+ /sbin/dhcpcd -z ${i} &>${devnull} || break
+ sleep 1
+ done
+ [[ ${count} -lt 9 ]]
+ eend $? "Timed out"
+ fi
+ ebegin " Stopping ${i}"
+ ifconfig ${i} down &>${devnull}
+ eend 0
+ done
+
+ return 0
+}
+
+start() {
+ # These variables are set by setup_vars
+ local status_IFACE vlans_IFACE dhcpcd_IFACE
+ local -a ifconfig_IFACE routes_IFACE inet6_IFACE
+
+ # Call user-defined preup function if it exists
+ if [[ $(type -t preup) == function ]]; then
+ einfo "Running preup function"
+ preup ${IFACE} || {
+ eerror "preup ${IFACE} failed"
+ return 1
+ }
+ fi
+
+ # Start the primary interface and aliases
+ setup_vars ${IFACE}
+ iface_start ${IFACE} || return 1
+
+ # Start vlans
+ local vlan
+ for vlan in ${vlans_IFACE}; do
+ /sbin/vconfig add ${IFACE} ${vlan} >${devnull}
+ setup_vars ${IFACE}.${vlan}
+ iface_start ${IFACE}.${vlan}
+ done
+
+ # Call user-defined postup function if it exists
+ if [[ $(type -t postup) == function ]]; then
+ einfo "Running postup function"
+ postup ${IFACE}
+ fi
+}
+
+stop() {
+ # Call user-defined predown function if it exists
+ if [[ $(type -t predown) == function ]]; then
+ einfo "Running predown function"
+ predown ${IFACE}
+ fi
+
+ # Don't depend on setup_vars since configuration might have changed.
+ # Investigate current configuration instead.
+ local vlan
+ for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
+ iface_stop ${vlan}
+ /sbin/vconfig rem ${vlan} >${devnull}
+ done
+
+ iface_stop ${IFACE} || return 1 # always succeeds, btw
+
+ # Call user-defined postdown function if it exists
+ if [[ $(type -t postdown) == function ]]; then
+ einfo "Running postdown function"
+ postdown ${IFACE}
+ fi
+}
+
+# vim:ts=4
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-14 17:44:36 +0000