--- /dev/null
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
+to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b>
+and IPv4 addresses. Upon the successful establishment of the IPsec tunnels,
+automatically inserted iptables-based firewall rules let pass the tunneled traffic.
+In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping the
+client <b>alice</b> behind the gateway <b>moon</b>.
--- /dev/null
+moon::ipsec statusall::rw.*ESTABLISHED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+
--- /dev/null
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+ crlcheckinterval=180
+ strictcrlpolicy=no
+ plutostart=no
+
+# configuration is read from SQLite database
--- /dev/null
+DROP TABLE IF EXISTS identities;
+CREATE TABLE identities (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL,
+ UNIQUE (type, data)
+);
+
+DROP TABLE IF EXISTS child_configs;
+CREATE TABLE child_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ name TEXT NOT NULL,
+ lifetime INTEGER NOT NULL DEFAULT '1200',
+ rekeytime INTEGER NOT NULL DEFAULT '1020',
+ jitter INTEGER NOT NULL DEFAULT '180',
+ updown TEXT DEFAULT NULL,
+ hostaccess INTEGER NOT NULL DEFAULT '0',
+ mode INTEGER NOT NULL DEFAULT '1'
+);
+DROP INDEX IF EXISTS child_configs_name;
+CREATE INDEX child_configs_name ON child_configs (
+ name
+);
+
+DROP TABLE IF EXISTS child_config_traffic_selector;
+CREATE TABLE child_config_traffic_selector (
+ child_cfg INTEGER NOT NULL,
+ traffic_selector INTEGER NOT NULL,
+ kind INTEGER NOT NULL
+);
+DROP INDEX IF EXISTS child_config_traffic_selector;
+CREATE INDEX child_config_traffic_selector_all ON child_config_traffic_selector (
+ child_cfg, traffic_selector
+);
+
+DROP TABLE IF EXISTS ike_configs;
+CREATE TABLE ike_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ certreq INTEGER NOT NULL DEFAULT '1',
+ force_encap INTEGER NOT NULL DEFAULT '0',
+ local TEXT NOT NULL,
+ remote TEXT NOT NULL
+);
+
+DROP TABLE IF EXISTS peer_configs;
+CREATE TABLE peer_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ name TEXT NOT NULL,
+ ike_version INTEGER NOT NULL DEFAULT '2',
+ ike_cfg INTEGER NOT NULL,
+ local_id TEXT NOT NULL,
+ remote_id TEXT NOT NULL,
+ cert_policy INTEGER NOT NULL DEFAULT '1',
+ auth_method INTEGER NOT NULL DEFAULT '1',
+ eap_type INTEGER NOT NULL DEFAULT '0',
+ eap_vendor INTEGER NOT NULL DEFAULT '0',
+ keyingtries INTEGER NOT NULL DEFAULT '1',
+ rekeytime INTEGER NOT NULL DEFAULT '0',
+ reauthtime INTEGER NOT NULL DEFAULT '3600',
+ jitter INTEGER NOT NULL DEFAULT '180',
+ overtime INTEGER NOT NULL DEFAULT '300',
+ mobike INTEGER NOT NULL DEFAULT '1',
+ dpd_delay INTEGER NOT NULL DEFAULT '120',
+ dpd_action INTEGER NOT NULL DEFAULT '1',
+ mediation INTEGER NOT NULL DEFAULT '0',
+ mediated_by INTEGER NOT NULL DEFAULT '0',
+ peer_id INTEGER NOT NULL DEFAULT '0'
+);
+DROP INDEX IF EXISTS peer_configs_name;
+CREATE INDEX peer_configs_name ON peer_configs (
+ name
+);
+
+DROP TABLE IF EXISTS peer_config_child_config;
+CREATE TABLE peer_config_child_config (
+ peer_cfg INTEGER NOT NULL,
+ child_cfg INTEGER NOT NULL,
+ PRIMARY KEY (peer_cfg, child_cfg)
+);
+
+DROP TABLE IF EXISTS traffic_selectors;
+CREATE TABLE traffic_selectors (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL DEFAULT '7',
+ protocol INTEGER NOT NULL DEFAULT '0',
+ start_addr BLOB DEFAULT NULL,
+ end_addr BLOB DEFAULT NULL,
+ start_port INTEGER NOT NULL DEFAULT '0',
+ end_port INTEGER NOT NULL DEFAULT '65535'
+);
+
+DROP TABLE IF EXISTS certificates;
+CREATE TABLE certificates (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ keytype INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS certificate_identity;
+CREATE TABLE certificate_identity (
+ certificate INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (certificate, identity)
+);
+
+DROP TABLE IF EXISTS private_keys;
+CREATE TABLE private_keys (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS private_key_identity;
+CREATE TABLE private_key_identity (
+ private_key INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (private_key, identity)
+);
+
+DROP TABLE IF EXISTS shared_secrets;
+CREATE TABLE shared_secrets (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS shared_secret_identity;
+CREATE TABLE shared_secret_identity (
+ shared_secret INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (shared_secret, identity)
+);
+
+DROP TABLE IF EXISTS ike_sas;
+CREATE TABLE ike_sas (
+ local_spi BLOB NOT NULL PRIMARY KEY,
+ remote_spi BLOB NOT NULL,
+ id INTEGER NOT NULL,
+ initiator INTEGER NOT NULL,
+ local_id_type INTEGER NOT NULL,
+ local_id_data BLOB NOT NULL,
+ remote_id_type INTEGER NOT NULL,
+ remote_id_data BLOB NOT NULL,
+ host_family INTEGER NOT NULL,
+ local_host_data BLOB NOT NULL,
+ remote_host_data BLOB NOT NULL,
+ created INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+DROP TABLE IF EXISTS logs;
+CREATE TABLE logs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ local_spi BLOB NOT NULL,
+ signal INTEGER NOT NULL,
+ level INTEGER NOT NULL,
+ msg TEXT NOT NULL,
+ time INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+/* Identities */
+
+INSERT INTO identities (
+ type, data
+) VALUES ( /* 192.168.0.1 */
+ 1 , X'c0a80001'
+ );
+
+INSERT INTO identities (
+ type, data
+) VALUES ( /* 192.168.0.100 */
+ 1 , X'c0a80064'
+ );
+
+/* Shared Secrets */
+
+INSERT INTO shared_secrets (
+ type, data
+) VALUES (
+ 1, X'16964066a10de938bdb2ab7864fe4459cab1'
+);
+
+INSERT INTO shared_secret_identity (
+ shared_secret, identity
+) VALUES (
+ 1, 1
+);
+
+INSERT INTO shared_secret_identity (
+ shared_secret, identity
+) VALUES (
+ 1, 2
+);
+
+/* Configurations */
+
+INSERT INTO ike_configs (
+ local, remote
+) VALUES (
+ 'PH_IP_CAROL', 'PH_IP_MOON'
+);
+
+INSERT INTO peer_configs (
+ name, ike_cfg, local_id, remote_id, auth_method
+) VALUES (
+ 'home', 1, 2, 1, 2
+);
+
+INSERT INTO child_configs (
+ name, updown
+) VALUES (
+ 'home', 'ipsec _updown iptables'
+);
+
+INSERT INTO peer_config_child_config (
+ peer_cfg, child_cfg
+) VALUES (
+ 1, 1
+);
+
+INSERT INTO traffic_selectors (
+ type, start_addr, end_addr
+) VALUES ( /* 10.1.0.0/16 */
+ 7, X'0a010000', X'0a01ffff'
+);
+
+INSERT INTO traffic_selectors (
+ type
+) VALUES ( /* dynamic/32 */
+ 7
+);
+
+INSERT INTO child_config_traffic_selector (
+ child_cfg, traffic_selector, kind
+) VALUES (
+ 1, 1, 1
+);
+
+INSERT INTO child_config_traffic_selector (
+ child_cfg, traffic_selector, kind
+) VALUES (
+ 1, 2, 2
+);
+
--- /dev/null
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+# secrets are read from SQLite database
--- /dev/null
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ plugins {
+ sql {
+ database = sqlite:///etc/ipsec.d/ipsec.db
+ }
+ }
+}
--- /dev/null
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+ crlcheckinterval=180
+ strictcrlpolicy=no
+ plutostart=no
+
+# configuration is read from SQLite database
--- /dev/null
+DROP TABLE IF EXISTS identities;
+CREATE TABLE identities (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL,
+ UNIQUE (type, data)
+);
+
+DROP TABLE IF EXISTS child_configs;
+CREATE TABLE child_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ name TEXT NOT NULL,
+ lifetime INTEGER NOT NULL DEFAULT '1200',
+ rekeytime INTEGER NOT NULL DEFAULT '1020',
+ jitter INTEGER NOT NULL DEFAULT '180',
+ updown TEXT DEFAULT NULL,
+ hostaccess INTEGER NOT NULL DEFAULT '0',
+ mode INTEGER NOT NULL DEFAULT '1'
+);
+DROP INDEX IF EXISTS child_configs_name;
+CREATE INDEX child_configs_name ON child_configs (
+ name
+);
+
+DROP TABLE IF EXISTS child_config_traffic_selector;
+CREATE TABLE child_config_traffic_selector (
+ child_cfg INTEGER NOT NULL,
+ traffic_selector INTEGER NOT NULL,
+ kind INTEGER NOT NULL
+);
+DROP INDEX IF EXISTS child_config_traffic_selector;
+CREATE INDEX child_config_traffic_selector_all ON child_config_traffic_selector (
+ child_cfg, traffic_selector
+);
+
+DROP TABLE IF EXISTS ike_configs;
+CREATE TABLE ike_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ certreq INTEGER NOT NULL DEFAULT '1',
+ force_encap INTEGER NOT NULL DEFAULT '0',
+ local TEXT NOT NULL,
+ remote TEXT NOT NULL
+);
+
+DROP TABLE IF EXISTS peer_configs;
+CREATE TABLE peer_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ name TEXT NOT NULL,
+ ike_version INTEGER NOT NULL DEFAULT '2',
+ ike_cfg INTEGER NOT NULL,
+ local_id TEXT NOT NULL,
+ remote_id TEXT NOT NULL,
+ cert_policy INTEGER NOT NULL DEFAULT '1',
+ auth_method INTEGER NOT NULL DEFAULT '1',
+ eap_type INTEGER NOT NULL DEFAULT '0',
+ eap_vendor INTEGER NOT NULL DEFAULT '0',
+ keyingtries INTEGER NOT NULL DEFAULT '1',
+ rekeytime INTEGER NOT NULL DEFAULT '0',
+ reauthtime INTEGER NOT NULL DEFAULT '3600',
+ jitter INTEGER NOT NULL DEFAULT '180',
+ overtime INTEGER NOT NULL DEFAULT '300',
+ mobike INTEGER NOT NULL DEFAULT '1',
+ dpd_delay INTEGER NOT NULL DEFAULT '120',
+ dpd_action INTEGER NOT NULL DEFAULT '1',
+ mediation INTEGER NOT NULL DEFAULT '0',
+ mediated_by INTEGER NOT NULL DEFAULT '0',
+ peer_id INTEGER NOT NULL DEFAULT '0'
+);
+DROP INDEX IF EXISTS peer_configs_name;
+CREATE INDEX peer_configs_name ON peer_configs (
+ name
+);
+
+DROP TABLE IF EXISTS peer_config_child_config;
+CREATE TABLE peer_config_child_config (
+ peer_cfg INTEGER NOT NULL,
+ child_cfg INTEGER NOT NULL,
+ PRIMARY KEY (peer_cfg, child_cfg)
+);
+
+DROP TABLE IF EXISTS traffic_selectors;
+CREATE TABLE traffic_selectors (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL DEFAULT '7',
+ protocol INTEGER NOT NULL DEFAULT '0',
+ start_addr BLOB DEFAULT NULL,
+ end_addr BLOB DEFAULT NULL,
+ start_port INTEGER NOT NULL DEFAULT '0',
+ end_port INTEGER NOT NULL DEFAULT '65535'
+);
+
+DROP TABLE IF EXISTS certificates;
+CREATE TABLE certificates (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ keytype INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS certificate_identity;
+CREATE TABLE certificate_identity (
+ certificate INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (certificate, identity)
+);
+
+DROP TABLE IF EXISTS private_keys;
+CREATE TABLE private_keys (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS private_key_identity;
+CREATE TABLE private_key_identity (
+ private_key INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (private_key, identity)
+);
+
+DROP TABLE IF EXISTS shared_secrets;
+CREATE TABLE shared_secrets (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS shared_secret_identity;
+CREATE TABLE shared_secret_identity (
+ shared_secret INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (shared_secret, identity)
+);
+
+DROP TABLE IF EXISTS ike_sas;
+CREATE TABLE ike_sas (
+ local_spi BLOB NOT NULL PRIMARY KEY,
+ remote_spi BLOB NOT NULL,
+ id INTEGER NOT NULL,
+ initiator INTEGER NOT NULL,
+ local_id_type INTEGER NOT NULL,
+ local_id_data BLOB NOT NULL,
+ remote_id_type INTEGER NOT NULL,
+ remote_id_data BLOB NOT NULL,
+ host_family INTEGER NOT NULL,
+ local_host_data BLOB NOT NULL,
+ remote_host_data BLOB NOT NULL,
+ created INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+DROP TABLE IF EXISTS logs;
+CREATE TABLE logs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ local_spi BLOB NOT NULL,
+ signal INTEGER NOT NULL,
+ level INTEGER NOT NULL,
+ msg TEXT NOT NULL,
+ time INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+/* Identities */
+
+INSERT INTO identities (
+ type, data
+) VALUES ( /* 192.168.0.1 */
+ 1 , X'c0a80001'
+ );
+
+INSERT INTO identities (
+ type, data
+) VALUES ( /* 192.168.0.200 */
+ 1 , X'c0a800c8'
+ );
+
+/* Shared Secrets */
+
+INSERT INTO shared_secrets (
+ type, data
+) VALUES (
+ 1, X'8d5cce342174da772c8224a59885deaa118d'
+);
+
+INSERT INTO shared_secret_identity (
+ shared_secret, identity
+) VALUES (
+ 1, 1
+);
+
+INSERT INTO shared_secret_identity (
+ shared_secret, identity
+) VALUES (
+ 1, 2
+);
+
+/* Configurations */
+
+INSERT INTO ike_configs (
+ local, remote
+) VALUES (
+ 'PH_IP_DAVE', 'PH_IP_MOON'
+);
+
+INSERT INTO peer_configs (
+ name, ike_cfg, local_id, remote_id, auth_method
+) VALUES (
+ 'home', 1, 2, 1, 2
+);
+
+INSERT INTO child_configs (
+ name, updown
+) VALUES (
+ 'home', 'ipsec _updown iptables'
+);
+
+INSERT INTO peer_config_child_config (
+ peer_cfg, child_cfg
+) VALUES (
+ 1, 1
+);
+
+INSERT INTO traffic_selectors (
+ type, start_addr, end_addr
+) VALUES ( /* 10.1.0.0/16 */
+ 7, X'0a010000', X'0a01ffff'
+);
+
+INSERT INTO traffic_selectors (
+ type
+) VALUES ( /* dynamic/32 */
+ 7
+);
+
+INSERT INTO child_config_traffic_selector (
+ child_cfg, traffic_selector, kind
+) VALUES (
+ 1, 1, 1
+);
+
+INSERT INTO child_config_traffic_selector (
+ child_cfg, traffic_selector, kind
+) VALUES (
+ 1, 2, 2
+);
+
--- /dev/null
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+# secrets are read from SQLite database
--- /dev/null
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ plugins {
+ sql {
+ database = sqlite:///etc/ipsec.d/ipsec.db
+ }
+ }
+}
--- /dev/null
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+ crlcheckinterval=180
+ strictcrlpolicy=no
+ plutostart=no
+
+# configuration is read from SQLite database
--- /dev/null
+DROP TABLE IF EXISTS identities;
+CREATE TABLE identities (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL,
+ UNIQUE (type, data)
+);
+
+DROP TABLE IF EXISTS child_configs;
+CREATE TABLE child_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ name TEXT NOT NULL,
+ lifetime INTEGER NOT NULL DEFAULT '1200',
+ rekeytime INTEGER NOT NULL DEFAULT '1020',
+ jitter INTEGER NOT NULL DEFAULT '180',
+ updown TEXT DEFAULT NULL,
+ hostaccess INTEGER NOT NULL DEFAULT '0',
+ mode INTEGER NOT NULL DEFAULT '1'
+);
+DROP INDEX IF EXISTS child_configs_name;
+CREATE INDEX child_configs_name ON child_configs (
+ name
+);
+
+DROP TABLE IF EXISTS child_config_traffic_selector;
+CREATE TABLE child_config_traffic_selector (
+ child_cfg INTEGER NOT NULL,
+ traffic_selector INTEGER NOT NULL,
+ kind INTEGER NOT NULL
+);
+DROP INDEX IF EXISTS child_config_traffic_selector;
+CREATE INDEX child_config_traffic_selector_all ON child_config_traffic_selector (
+ child_cfg, traffic_selector
+);
+
+DROP TABLE IF EXISTS ike_configs;
+CREATE TABLE ike_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ certreq INTEGER NOT NULL DEFAULT '1',
+ force_encap INTEGER NOT NULL DEFAULT '0',
+ local TEXT NOT NULL,
+ remote TEXT NOT NULL
+);
+
+DROP TABLE IF EXISTS peer_configs;
+CREATE TABLE peer_configs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ name TEXT NOT NULL,
+ ike_version INTEGER NOT NULL DEFAULT '2',
+ ike_cfg INTEGER NOT NULL,
+ local_id TEXT NOT NULL,
+ remote_id TEXT NOT NULL,
+ cert_policy INTEGER NOT NULL DEFAULT '1',
+ auth_method INTEGER NOT NULL DEFAULT '1',
+ eap_type INTEGER NOT NULL DEFAULT '0',
+ eap_vendor INTEGER NOT NULL DEFAULT '0',
+ keyingtries INTEGER NOT NULL DEFAULT '1',
+ rekeytime INTEGER NOT NULL DEFAULT '0',
+ reauthtime INTEGER NOT NULL DEFAULT '3600',
+ jitter INTEGER NOT NULL DEFAULT '180',
+ overtime INTEGER NOT NULL DEFAULT '300',
+ mobike INTEGER NOT NULL DEFAULT '1',
+ dpd_delay INTEGER NOT NULL DEFAULT '120',
+ dpd_action INTEGER NOT NULL DEFAULT '1',
+ mediation INTEGER NOT NULL DEFAULT '0',
+ mediated_by INTEGER NOT NULL DEFAULT '0',
+ peer_id INTEGER NOT NULL DEFAULT '0'
+);
+DROP INDEX IF EXISTS peer_configs_name;
+CREATE INDEX peer_configs_name ON peer_configs (
+ name
+);
+
+DROP TABLE IF EXISTS peer_config_child_config;
+CREATE TABLE peer_config_child_config (
+ peer_cfg INTEGER NOT NULL,
+ child_cfg INTEGER NOT NULL,
+ PRIMARY KEY (peer_cfg, child_cfg)
+);
+
+DROP TABLE IF EXISTS traffic_selectors;
+CREATE TABLE traffic_selectors (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL DEFAULT '7',
+ protocol INTEGER NOT NULL DEFAULT '0',
+ start_addr BLOB DEFAULT NULL,
+ end_addr BLOB DEFAULT NULL,
+ start_port INTEGER NOT NULL DEFAULT '0',
+ end_port INTEGER NOT NULL DEFAULT '65535'
+);
+
+DROP TABLE IF EXISTS certificates;
+CREATE TABLE certificates (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ keytype INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS certificate_identity;
+CREATE TABLE certificate_identity (
+ certificate INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (certificate, identity)
+);
+
+DROP TABLE IF EXISTS private_keys;
+CREATE TABLE private_keys (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS private_key_identity;
+CREATE TABLE private_key_identity (
+ private_key INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (private_key, identity)
+);
+
+DROP TABLE IF EXISTS shared_secrets;
+CREATE TABLE shared_secrets (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ type INTEGER NOT NULL,
+ data BLOB NOT NULL
+);
+
+DROP TABLE IF EXISTS shared_secret_identity;
+CREATE TABLE shared_secret_identity (
+ shared_secret INTEGER NOT NULL,
+ identity INTEGER NOT NULL,
+ PRIMARY KEY (shared_secret, identity)
+);
+
+DROP TABLE IF EXISTS ike_sas;
+CREATE TABLE ike_sas (
+ local_spi BLOB NOT NULL PRIMARY KEY,
+ remote_spi BLOB NOT NULL,
+ id INTEGER NOT NULL,
+ initiator INTEGER NOT NULL,
+ local_id_type INTEGER NOT NULL,
+ local_id_data BLOB NOT NULL,
+ remote_id_type INTEGER NOT NULL,
+ remote_id_data BLOB NOT NULL,
+ host_family INTEGER NOT NULL,
+ local_host_data BLOB NOT NULL,
+ remote_host_data BLOB NOT NULL,
+ created INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+DROP TABLE IF EXISTS logs;
+CREATE TABLE logs (
+ id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+ local_spi BLOB NOT NULL,
+ signal INTEGER NOT NULL,
+ level INTEGER NOT NULL,
+ msg TEXT NOT NULL,
+ time INTEGER NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+/* Identities */
+
+INSERT INTO identities (
+ type, data
+) VALUES ( /* 192.168.0.1 */
+ 1 , X'c0a80001'
+ );
+
+INSERT INTO identities (
+ type, data
+) VALUES ( /* 192.168.0.100 */
+ 1 , X'c0a80064'
+ );
+
+INSERT INTO identities (
+ type, data
+) VALUES ( /* 192.168.0.200 */
+ 1 , X'c0a800c8'
+ );
+
+INSERT INTO identities (
+ type, data
+) VALUES ( /* %any */
+ 0, '%any'
+);
+
+/* Shared Secrets */
+
+INSERT INTO shared_secrets (
+ type, data
+) VALUES (
+ 1, X'16964066a10de938bdb2ab7864fe4459cab1'
+);
+
+INSERT INTO shared_secrets (
+ type, data
+) VALUES (
+ 1, X'8d5cce342174da772c8224a59885deaa118d'
+);
+
+INSERT INTO shared_secret_identity (
+ shared_secret, identity
+) VALUES (
+ 1, 1
+);
+
+INSERT INTO shared_secret_identity (
+ shared_secret, identity
+) VALUES (
+ 1, 2
+);
+
+INSERT INTO shared_secret_identity (
+ shared_secret, identity
+) VALUES (
+ 2, 1
+);
+
+INSERT INTO shared_secret_identity (
+ shared_secret, identity
+) VALUES (
+ 2, 3
+);
+
+/* Configurations */
+
+INSERT INTO ike_configs (
+ local, remote
+) VALUES (
+ 'PH_IP_MOON', '0.0.0.0'
+);
+
+INSERT INTO peer_configs (
+ name, ike_cfg, local_id, remote_id, auth_method
+) VALUES (
+ 'rw', 1, 1, 4, 2
+);
+
+INSERT INTO child_configs (
+ name, updown
+) VALUES (
+ 'rw', 'ipsec _updown iptables'
+);
+
+INSERT INTO peer_config_child_config (
+ peer_cfg, child_cfg
+) VALUES (
+ 1, 1
+);
+
+INSERT INTO traffic_selectors (
+ type, start_addr, end_addr
+) VALUES ( /* 10.1.0.0/16 */
+ 7, X'0a010000', X'0a01ffff'
+);
+
+INSERT INTO traffic_selectors (
+ type
+) VALUES ( /* dynamic/32 */
+ 7
+);
+
+INSERT INTO child_config_traffic_selector (
+ child_cfg, traffic_selector, kind
+) VALUES (
+ 1, 1, 0
+);
+
+INSERT INTO child_config_traffic_selector (
+ child_cfg, traffic_selector, kind
+) VALUES (
+ 1, 2, 3
+);
+
--- /dev/null
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+# secrets are read from SQLite database
--- /dev/null
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+ plugins {
+ sql {
+ database = sqlite:///etc/ipsec.d/ipsec.db
+ }
+ }
+}
--- /dev/null
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+moon::rm /etc/ipsec.d/ipsec.db
+carol::rm /etc/ipsec.d/ipsec.db
+dave::rm /etc/ipsec.d/ipsec.db
+~
--- /dev/null
+moon::rm /etc/ipsec.d/cacerts/*
+carol::rm /etc/ipsec.d/cacerts/*
+dave::rm /etc/ipsec.d/cacerts/*
+moon::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
+carol::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
+dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
--- /dev/null
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"