dowhack

This a good VPN source

	me --name ipsec-psk-rw --initiate
	;;

# although an ID payload comes too late for PSK,
# it is legal.
dipsec-psk-id-rw)
	me --name ipsec-psk-id-rw --delete --psk \
		$WESTNET --id=@west.example.com $TO $EASTNET \
		--encrypt $TIMES2
	him --name ipsec-psk-id-rw --delete --psk \
		$ANYHOST --id=@west.example.com --client $WESTSUBNET \
		$TO $EASTNET --nexthop %direct \
		--encrypt $TIMES2
	;;
xipsec-psk-id-rw)
	me --name ipsec-psk-id-rw --initiate
	;;

dipsec-rsa-rw|dipsec-dnsrsa-rw)
	me --name ipsec-rsa-rw --delete --rsa \
		$WESTNET $TO_RSA $EASTNET \
		--encrypt $TIMES2
	him --name ipsec-rsa-rw --delete --rsa \
		$ANYHOST --client $WESTSUBNET \
		$TO_RSA $EASTNET --nexthop %direct \
		--encrypt $TIMES2
	;;
xipsec-rsa-rw|xipsec-dnsrsa-rw)
	me --name ipsec-rsa-rw --initiate
	;;

# Opportunism
# --pfs and --rsa required

dipsec-oppo)
	# self
	me --name ipsec-oppo-me --delete --rsa --pfs \
		$WESTHOST --nexthop $ROUTER \
		$TO $OPPO \
		--encrypt $TIMES2
	# clients
	me --name ipsec-oppo-mine --delete --rsa --pfs \
		$WESTNET --nexthop $ROUTER \
		$TO $OPPO \
		--encrypt $TIMES2
	# self
	him --name ipsec-oppo-me --delete --rsa --pfs \
		$OPPO \
		$TO $EASTHOST --nexthop $ROUTER \
		--encrypt $TIMES2
	# clients
	him --name ipsec-oppo-mine --delete --rsa --pfs \
		$OPPO \
		$TO $EASTNET --nexthop $ROUTER \
		--encrypt $TIMES2
	;;
xipsec-oppo)
	me --route --name ipsec-oppo-me
	me --route --name ipsec-oppo-mine
	# host to host
	me --oppohere $WESTIP --oppothere $EASTIP

	# host to client
	me --oppohere $WESTIP --oppothere $TRURO

	# client to host
	me --oppohere $VANCOUVER --oppothere $EASTIP

	# client to client
	me --oppohere $VICTORIA --oppothere $ANTIGONISH

	# whack error: 0.0.0.0 or 0::0 isn't a valid client address "0.0.0.0"
	# me --oppohere 0.0.0.0 --oppothere $ANTIGONISH

	# whack error: 0.0.0.0 or 0::0 isn't a valid client address "0.0.0.0"
	# me --oppohere $VICTORIA --oppothere 0.0.0.0

	# 033 Can't Opportunistically initiate for 127.95.7.22 to 127.95.7.10: no Opportunistic template covers them
	me --oppohere $ANTIGONISH --oppothere $VICTORIA

	# 033 Can't Opportunistically initiate for 127.95.7.10 to 127.95.7.23: no host 23.7.95.127.in-addr.arpa. for TXT record
	me --oppohere $VICTORIA --oppothere $ATLANTIS

	# [used to be] Responder says: "ipsec-oppo-me" 127.95.7.1 0.0.0.0/32 #1: gateway 127.95.7.1 claims client 127.95.7.8, but DNS for client fails to confirm: no host 8.7.95.127.in-addr.arpa. for TXT record
	# [now that checking of our records is done] Initiator: 033 Can't Opportunistically initiate for 127.95.7.8 to 127.95.7.22: no host 8.7.95.127.in-addr.arpa. for TXT record
	me --oppohere $VANISHED --oppothere $ANTIGONISH
	;;

# exactly like ipsec-oppo, except opportunism is limited to narrow target
dipsec-oppo-narrow)
	# self
	me --name ipsec-oppo-me --delete --rsa --pfs \
		$WESTHOST --nexthop  $ROUTER \
		$TO $OPPONARROW \
		--encrypt $TIMES2
	# clients
	me --name ipsec-oppo-mine --delete --rsa --pfs \
		$WESTNET --nexthop  $ROUTER \
		$TO $OPPONARROW \
		--encrypt $TIMES2
	# self
	him --name ipsec-oppo-me --delete --rsa --pfs \
		$OPPONARROW \
		$TO $EASTHOST --nexthop $ROUTER \
		--encrypt $TIMES2
	# clients
	him --name ipsec-oppo-mine --delete --rsa --pfs \
		$OPPONARROW \
		$TO $EASTNET --nexthop $ROUTER \
		--encrypt $TIMES2
	;;
xipsec-oppo-narrow)
	me --route --name ipsec-oppo-me
	me --route --name ipsec-oppo-mine
	both_status

	# host to host
	me --oppohere $WESTIP --oppothere $EASTIP

	# host to client
	me --oppohere $WESTIP --oppothere $TRURO

	# client to host
	me --oppohere $VANCOUVER --oppothere $EASTIP

	# client to client
	me --oppohere $VICTORIA --oppothere $ANTIGONISH

	# whack error: 0.0.0.0 or 0::0 isn't a valid client address "0.0.0.0"
	# me --oppohere 0.0.0.0 --oppothere $ANTIGONISH

	# whack error: 0.0.0.0 or 0::0 isn't a valid client address "0.0.0.0"
	# me --oppohere $VICTORIA --oppothere 0.0.0.0

	# 033 Can't Opportunistically initiate for 127.95.7.22 to 127.95.7.10: no routed Opportunistic template covers this pair
	me --oppohere $ANTIGONISH --oppothere $VICTORIA

	# 033 Can't Opportunistically initiate for 127.95.7.10 to 127.95.7.23: no host 23.7.95.127.in-addr.arpa. for TXT record
	me --oppohere $VICTORIA --oppothere $ATLANTIS

	# Responder says: "ipsec-oppo-me" 127.95.7.1 0.0.0.0/32 #1: gateway 127.95.7.1 claims client 127.95.7.8, but DNS for client fails to confirm: no host 8.7.95.127.in-addr.arpa. for TXT record
	# Initiator slowly times out.
	# me --oppohere $VANISHED --oppothere $ANTIGONISH
	;;

# exactly like ipsec-oppo-narrow, except real target isn't in range
dipsec-oppo-miss)
	# self
	me --name ipsec-oppo-me --delete --rsa --pfs \
		$WESTHOST --nexthop $ROUTER \
		$TO $OPPOMISS \
		--encrypt $TIMES2
	# clients
	me --name ipsec-oppo-mine --delete --rsa --pfs \
		$WESTNET --nexthop $ROUTER \
		$TO $OPPOMISS \
		--encrypt $TIMES2
	# self
	him --name ipsec-oppo-me --delete --rsa --pfs \
		$OPPOMISS \
		$TO $EASTHOST --nexthop $ROUTER \
		--encrypt $TIMES2
	# clients
	him --name ipsec-oppo-mine --delete --rsa --pfs \
		$OPPOMISS \
		$TO $EASTNET --nexthop $ROUTER \
		--encrypt $TIMES2
	;;
xipsec-oppo-miss)
	me --route --name ipsec-oppo-me
	me --route --name ipsec-oppo-mine
	both_status

	# host to host
	me --oppohere $WESTIP --oppothere $EASTIP

	# host to client
	me --oppohere $WESTIP --oppothere $TRURO

	# client to host
	me --oppohere $VANCOUVER --oppothere $EASTIP

	# client to client
	me --oppohere $VICTORIA --oppothere $ANTIGONISH

	# whack error: 0.0.0.0 or 0::0 isn't a valid client address "0.0.0.0"
	# me --oppohere 0.0.0.0 --oppothere $ANTIGONISH

	# whack error: 0.0.0.0 or 0::0 isn't a valid client address "0.0.0.0"
	# me --oppohere $VICTORIA --oppothere 0.0.0.0

	# 033 no suitable connection for opportunism between 127.95.7.22 and 127.95.7.10 with 127.95.7.1 as peer
	me --oppohere $ANTIGONISH --oppothere $VICTORIA

	# 033 Can't Opportunistically initiate for 127.95.7.10 to 127.95.7.23: no host 23.7.95.127.in-addr.arpa. for TXT record
	me --oppohere $VICTORIA --oppothere $ATLANTIS

	# Responder says: "ipsec-oppo-me" 127.95.7.1 0.0.0.0/32 #1: gateway 127.95.7.1 claims client 127.95.7.8, but DNS for client fails to confirm: no host 8.7.95.127.in-addr.arpa. for TXT record
	# Initiator slowly times out.
	# me --oppohere $VANISHED --oppothere $ANTIGONISH
	;;

# opportunism both ways at once
# This is a regression test: asynchrony introduced with ADNS invalidated some assumptions.
# Use distinct names to make log clearer.
# Doesn't fit into framework, so not automatically run.
dipsec-oppo-race)
	# self
	me --name ipsec-oppo-west --delete --rsa --pfs \
		$WESTHOST --nexthop %direct \
		$TO $OPPO \
		--encrypt $TIMES2
	# self
	him --name ipsec-oppo-east --delete --rsa --pfs \
		$OPPO \
		$TO $EASTHOST --nexthop %direct \
		--encrypt $TIMES2
	;;
xipsec-oppo-race)
	# host to host
	# Use & to allow initiation to be interleaved with responding.
	# "sleep 1" is to make sure (!) that initiation gets started.
	# Delay our ADNS, but only for first query (TXT, initiation).
	me --impair-delay-adns-txt-answer --debug-all --debug-private
	me --oppohere $WESTIP --oppothere $EASTIP &
	sleep 1
	me --debug-all --debug-private
	him  --oppohere $EASTIP --oppothere $WESTIP
	wait
	;;

# similar to dipsec-oppo-race, but east is SG for truro
# Start west initiating first; responding happens within
# timespan of initiation.
dipsec-oppo-race-rini-net)
	# self
	me --name ipsec-oppo-west --delete --rsa --pfs \
		$WESTHOST --nexthop %direct \
		$TO $OPPO \
		--encrypt $TIMES2
	# self
	him --name ipsec-oppo-eastnet --delete --rsa --pfs \
		$OPPO \
		$TO $EASTNET --nexthop %direct \
		--encrypt $TIMES2
	;;
xipsec-oppo-race-rini-net)
	# host to host
	# Use & to allow initiation to be interleaved with responding.
	# "sleep 1" is to make sure (!) that initiation gets started.
	# Delay our ADNS, but only for first query (TXT, initiation).
	me --impair-delay-adns-txt-answer --debug-all --debug-private
	me --oppohere $WESTIP --oppothere $TRURO &
	sleep 1
	me --debug-all --debug-private
	him  --oppohere $TRURO --oppothere $WESTIP
	wait
	;;

# similar to dipsec-oppo-race-net, but reverse order of race:
# Start west responding first; initiation happens within
# timespan of responding.
# This test would drive 1.98 to assertion failure
# if the impairment mechanism were in 1.98:
# ASSERTION FAILED at ipsec_doi.c:2991: gateways_from_dns == NULL
dipsec-oppo-race-iinr-net)
	# self
	me --name ipsec-oppo-west --delete --rsa --pfs \
		$WESTHOST --nexthop %direct \
		$TO $OPPO \
		--encrypt $TIMES2
	# self
	him --name ipsec-oppo-eastnet --delete --rsa --pfs \
		$OPPO \
		$TO $EASTNET --nexthop %direct \
		--encrypt $TIMES2
	;;
xipsec-oppo-race-iinr-net)
	# host to host
	# Use & to allow initiation to be interleaved with responding.
	# "sleep 1" is to make sure (!) that initiation gets started.
	# Delay our ADNS, but only for TXT query (second, responding).
	me --impair-delay-adns-txt-answer --debug-all --debug-private
	him  --oppohere $TRURO --oppothere $WESTIP &
	sleep 1
	me --debug-all --debug-private
	me --oppohere $WESTIP --oppothere $TRURO
	wait
	;;

# same as ipsec-oppo-race, but strictly sequential

dipsec-oppo-seq)
	# self
	me --name ipsec-oppo-west --delete --rsa --pfs \
		$WESTHOST --nexthop $ROUTER \
		$TO $OPPO \
		--encrypt $TIMES2
	# self
	him --name ipsec-oppo-east --delete --rsa --pfs \
		$OPPO \
		$TO $EASTHOST --nexthop $ROUTER \
		--encrypt $TIMES2
	;;
xipsec-oppo-seq)
	me --route --name ipsec-oppo-west
	him --route --name ipsec-oppo-east
	# host to host
	me --oppohere $WESTIP --oppothere $EASTIP
	him  --oppohere $EASTIP --oppothere $WESTIP
	;;

# twice the same way

dipsec-oppo-twice)
	# self
	me --name ipsec-oppo-west --delete --rsa --pfs \
		$WESTHOST --nexthop $ROUTER \
		$TO $OPPO \
		--encrypt $TIMES2
	# self
	him --name ipsec-oppo-east --delete --rsa --pfs \
		$OPPO \
		$TO $EASTHOST --nexthop $ROUTER \
		--encrypt $TIMES2
	;;
xipsec-oppo-twice)
	me --route --name ipsec-oppo-west
	# host to host
	me --oppohere $WESTIP --oppothere $EASTIP
	me --oppohere $WESTIP --oppothere $EASTIP
	both_status
	;;