comments {
Sample scenario showing VPNClient and VPNServer service configuration.

This topology features an OpenVPN client and server for virtual private
networking. The client can access the private 10.0.6.0/24 network via the VPN
server. First wait until routing converges in the center routers (try using the
Adjacency Widget and wait for blue lines, meaning full adjacencies), then open
a shell on the vpnclient and try pinging the private address of the vpnserver:

  vpnclient> ping 10.0.6.1

You can also access the other 10.0.6.* hosts behind the server. Try running
tcpudmp on one of the center routers, e.g. the n2 eth1/10.0.5.2 interface, and
you'll see UDP packets with TLS encrypted data instead of ICMP packets.

Keys are included as extra files in the VPNClient and VPNServer service
configuration.
}

node n1 {
    type router
    model router
    network-config {
	hostname n1
	!
	interface eth2
	 ip address 10.0.4.2/24
	 ipv6 address 2001:4::2/64
	!
	interface eth1
	 ip address 10.0.2.1/24
	 ipv6 address 2001:2::1/64
	!
	interface eth0
	 ip address 10.0.0.1/24
	 ipv6 address 2001:0::1/64
	!
    }
    canvas c1
    iconcoords {297.0 236.0}
    labelcoords {297.0 264.0}
    interface-peer {eth0 n6}
    interface-peer {eth1 n2}
    interface-peer {eth2 n3}
}

node n2 {
    type router
    model router
    network-config {
	hostname n2
	!
	interface eth1
	 ip address 10.0.5.2/24
	 ipv6 address 2001:5::2/64
	!
	interface eth0
	 ip address 10.0.2.2/24
	 ipv6 address 2001:2::2/64
	!
    }
    canvas c1
    iconcoords {298.0 432.0}
    labelcoords {298.0 460.0}
    interface-peer {eth0 n1}
    interface-peer {eth1 n4}
}

node n3 {
    type router
    model router
    network-config {
	hostname n3
	!
	interface eth1
	 ip address 10.0.4.1/24
	 ipv6 address 2001:4::1/64
	!
	interface eth0
	 ip address 10.0.3.1/24
	 ipv6 address 2001:3::1/64
	!
    }
    canvas c1
    iconcoords {573.0 233.0}
    labelcoords {573.0 261.0}
    interface-peer {eth0 n4}
    interface-peer {eth1 n1}
}

node n4 {
    type router
    model router
    network-config {
	hostname n4
	!
	interface eth2
	 ip address 10.0.5.1/24
	 ipv6 address 2001:5::1/64
	!
	interface eth1
	 ip address 10.0.3.2/24
	 ipv6 address 2001:3::2/64
	!
	interface eth0
	 ip address 10.0.1.1/24
	 ipv6 address 2001:1::1/64
	!
    }
    canvas c1
    iconcoords {574.0 429.0}
    labelcoords {574.0 457.0}
    interface-peer {eth0 n5}
    interface-peer {eth1 n3}
    interface-peer {eth2 n2}
}

node n5 {
    type router
    model host
    network-config {
	hostname vpnserver
	!
	interface eth1
	 ipv6 address 2001:6::10/64
	 ip address 10.0.6.1/24
	!
	interface eth0
	 ip address 10.0.1.10/24
	 ipv6 address 2001:1::10/64
	!
    }
    canvas c1
    iconcoords {726.0 511.0}
    labelcoords {726.0 543.0}
    interface-peer {eth0 n4}
    interface-peer {eth1 n7}
    custom-config {
	custom-config-id service:VPNServer:vpnserver.pem
	custom-command vpnserver.pem
	config {
	Certificate:
	    Data:
	        Version: 3 (0x2)
	        Serial Number: 1 (0x1)
	    Signature Algorithm: sha256WithRSAEncryption
	        Issuer: C=US, ST=WA, O=core-dev/emailAddress=root@localhost
	        Validity
	            Not Before: May 19 02:09:57 2015 GMT
	            Not After : Apr 25 02:09:57 2115 GMT
	        Subject: C=US, ST=WA, O=core-dev, CN=vpnserver/emailAddress=root@localhost
	        Subject Public Key Info:
	            Public Key Algorithm: rsaEncryption
	                Public-Key: (2048 bit)
	                Modulus:
	                    00:d2:88:b2:9b:32:ac:38:ca:45:e0:6b:db:1c:92:
	                    5d:9a:42:23:df:64:a0:3b:c2:c4:f2:3a:75:bb:d6:
	                    54:12:61:6e:aa:ac:0f:a6:2e:d9:3b:63:dc:3d:48:
	                    02:f1:36:c8:97:d3:ef:24:6f:7f:dd:b7:9a:9d:6d:
	                    c1:c9:e2:11:49:1c:e0:67:d6:b0:b7:62:84:9a:f8:
	                    c3:af:4f:f7:77:29:74:01:81:47:49:84:d6:1c:0c:
	                    36:41:42:a2:3e:92:28:83:50:7a:9c:fd:f3:66:7c:
	                    f8:d9:c7:f6:63:d2:59:d2:fd:9a:a4:9b:75:a6:16:
	                    ec:37:de:05:dd:05:a2:31:65:79:66:eb:b3:82:41:
	                    af:b9:e8:4a:bc:02:d6:a1:68:49:6c:09:e1:c5:9f:
	                    3e:cf:52:76:d9:63:65:7a:a5:34:75:ee:ce:a3:c6:
	                    92:f3:0d:2f:7f:b0:b4:12:fe:44:5f:77:10:25:98:
	                    b2:45:af:69:c8:9b:13:fc:f9:de:c6:be:b5:cf:62:
	                    06:01:32:71:d5:84:1d:14:b9:28:46:80:f6:98:35:
	                    12:e4:c8:e4:7a:94:e5:99:a3:6b:34:de:be:33:fe:
	                    63:21:a3:cc:c4:64:15:49:e0:9d:57:84:b9:11:e5:
	                    05:79:ba:22:6e:e4:24:b0:64:f0:54:13:1a:f4:73:
	                    8a:ff
	                Exponent: 65537 (0x10001)
	        X509v3 extensions:
	            X509v3 Basic Constraints: 
	                CA:FALSE
	            Netscape Cert Type: 
	                SSL Server
	            Netscape Comment: 
	                OpenSSL Generated Server Certificate
	            X509v3 Subject Key Identifier: 
	                A5:A6:80:4D:3C:CD:E2:FE:AD:32:FD:9D:B2:7C:B6:00:76:16:C0:41
	            X509v3 Authority Key Identifier: 
	                keyid:DB:D2:9C:8D:22:D9:D7:E2:38:A0:8D:6C:3B:BE:33:CE:8D:2A:BE:C8
	                DirName:/C=US/ST=WA/O=core-dev/emailAddress=root@localhost
	                serial:CE:78:96:91:DB:9B:84:FD
	
	            X509v3 Extended Key Usage: 
	                TLS Web Server Authentication
	            X509v3 Key Usage: 
	                Digital Signature, Key Encipherment
	    Signature Algorithm: sha256WithRSAEncryption
	         3b:40:af:3a:c0:95:10:bc:d4:63:4a:1b:0f:9d:af:9c:27:29:
	         34:c9:80:dc:c2:2d:72:40:0e:50:15:fe:b4:87:bc:59:56:de:
	         81:96:1f:4f:ec:1a:44:ce:23:ba:69:b1:f5:ed:4b:1a:22:cf:
	         16:17:29:f9:bb:69:12:3c:42:87:09:48:26:a2:b3:88:40:3e:
	         3c:06:92:e1:65:6e:c0:62:50:55:08:5d:a0:4b:3a:0f:ff:9d:
	         65:91:b9:bf:d3:69:b9:ac:27:83:2c:fd:5a:bd:58:d3:75:a0:
	         70:e6:21:e9:f0:0d:19:a6:5f:2b:2d:1f:c9:fb:72:73:06:40:
	         32:5a:f8:81:30:59:b7:cb:3a:a7:3e:6f:af:4c:4b:57:eb:4a:
	         d8:24:65:13:c3:86:fd:35:d3:6d:a0:3a:4b:63:40:9e:b4:98:
	         e0:a2:c7:f2:71:42:d5:08:72:95:fd:df:8f:05:e9:68:a8:f8:
	         13:db:e6:0a:ec:c2:df:29:65:33:52:57:52:e5:7e:1d:09:2c:
	         56:0b:cc:d3:2d:dd:46:72:f0:cb:8b:2d:53:c4:d3:9d:63:a6:
	         6e:9f:dd:1a:7c:b2:87:d1:9e:4e:a0:b2:36:85:4a:5e:89:f9:
	         01:82:94:3d:3a:86:17:84:48:d4:0c:c4:25:25:54:3f:d7:65:
	         6b:85:c2:44:b3:6a:f5:74:69:f4:be:b2:13:68:a0:99:82:88:
	         07:23:8e:a3:67:e0:88:07:fe:fd:ba:85:f8:8a:1f:ac:1e:7d:
	         ac:1e:f9:d1:3d:a8:fd:d9:91:9e:b2:3d:4f:f1:b4:80:9e:0b:
	         aa:bb:44:6a:20:08:68:a4:45:0e:21:21:4d:d1:5f:ab:a8:96:
	         5a:29:e1:0f:9a:ff:a4:58:c6:80:15:51:98:ac:3c:23:4e:9e:
	         8f:a2:34:c1:f6:4c:26:f0:33:8d:db:15:b9:30:03:a7:b3:17:
	         31:9f:9a:5a:e7:a1:10:5e:61:57:04:bf:9a:6f:ec:87:15:4e:
	         33:2a:0c:e4:4a:b0:66:ab:04:7a:32:4d:66:44:af:d9:ad:41:
	         a9:b1:05:c4:7d:2a:ba:2b:bb:c9:1e:5a:ff:cd:e0:e3:54:39:
	         b6:be:e2:70:6c:db:e6:71:dc:27:7e:ef:e9:11:1f:cb:fa:cd:
	         e1:57:a9:b9:ba:d6:69:fc:c0:d7:57:b0:51:4d:c4:2a:2f:1b:
	         99:fc:b7:65:11:99:fe:0b:58:4e:11:aa:06:c6:e1:53:20:c7:
	         56:0a:de:a6:65:c1:a6:41:e1:7b:1d:d7:17:45:b0:e4:66:50:
	         26:d8:85:c3:c3:93:2d:df:b0:35:6d:29:9a:6b:cc:cc:75:de:
	         cf:72:37:8b:2d:24:b2:45
	-----BEGIN CERTIFICATE-----
	MIIFQTCCAymgAwIBAgIBATANBgkqhkiG9w0BAQsFADBMMQswCQYDVQQGEwJVUzEL
	MAkGA1UECBMCV0ExETAPBgNVBAoTCGNvcmUtZGV2MR0wGwYJKoZIhvcNAQkBFg5y
	b290QGxvY2FsaG9zdDAgFw0xNTA1MTkwMjA5NTdaGA8yMTE1MDQyNTAyMDk1N1ow
	YDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQKEwhjb3JlLWRldjES
	MBAGA1UEAxMJdnBuc2VydmVyMR0wGwYJKoZIhvcNAQkBFg5yb290QGxvY2FsaG9z
	dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANKIspsyrDjKReBr2xyS
	XZpCI99koDvCxPI6dbvWVBJhbqqsD6Yu2Ttj3D1IAvE2yJfT7yRvf923mp1twcni
	EUkc4GfWsLdihJr4w69P93cpdAGBR0mE1hwMNkFCoj6SKINQepz982Z8+NnH9mPS
	WdL9mqSbdaYW7DfeBd0FojFleWbrs4JBr7noSrwC1qFoSWwJ4cWfPs9SdtljZXql
	NHXuzqPGkvMNL3+wtBL+RF93ECWYskWvacibE/z53sa+tc9iBgEycdWEHRS5KEaA
	9pg1EuTI5HqU5ZmjazTevjP+YyGjzMRkFUngnVeEuRHlBXm6Im7kJLBk8FQTGvRz
	iv8CAwEAAaOCARYwggESMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMG
	CWCGSAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNh
	dGUwHQYDVR0OBBYEFKWmgE08zeL+rTL9nbJ8tgB2FsBBMHwGA1UdIwR1MHOAFNvS
	nI0i2dfiOKCNbDu+M86NKr7IoVCkTjBMMQswCQYDVQQGEwJVUzELMAkGA1UECBMC
	V0ExETAPBgNVBAoTCGNvcmUtZGV2MR0wGwYJKoZIhvcNAQkBFg5yb290QGxvY2Fs
	aG9zdIIJAM54lpHbm4T9MBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIF
	oDANBgkqhkiG9w0BAQsFAAOCAgEAO0CvOsCVELzUY0obD52vnCcpNMmA3MItckAO
	UBX+tIe8WVbegZYfT+waRM4jummx9e1LGiLPFhcp+btpEjxChwlIJqKziEA+PAaS
	4WVuwGJQVQhdoEs6D/+dZZG5v9Npuawngyz9Wr1Y03WgcOYh6fANGaZfKy0fyfty
	cwZAMlr4gTBZt8s6pz5vr0xLV+tK2CRlE8OG/TXTbaA6S2NAnrSY4KLH8nFC1Qhy
	lf3fjwXpaKj4E9vmCuzC3yllM1JXUuV+HQksVgvM0y3dRnLwy4stU8TTnWOmbp/d
	Gnyyh9GeTqCyNoVKXon5AYKUPTqGF4RI1AzEJSVUP9dla4XCRLNq9XRp9L6yE2ig
	mYKIByOOo2fgiAf+/bqF+IofrB59rB750T2o/dmRnrI9T/G0gJ4LqrtEaiAIaKRF
	DiEhTdFfq6iWWinhD5r/pFjGgBVRmKw8I06ej6I0wfZMJvAzjdsVuTADp7MXMZ+a
	WuehEF5hVwS/mm/shxVOMyoM5EqwZqsEejJNZkSv2a1BqbEFxH0quiu7yR5a/83g
	41Q5tr7icGzb5nHcJ37v6REfy/rN4VepubrWafzA11ewUU3EKi8bmfy3ZRGZ/gtY
	ThGqBsbhUyDHVgrepmXBpkHhex3XF0Ww5GZQJtiFw8OTLd+wNW0pmmvMzHXez3I3
	iy0kskU=
	-----END CERTIFICATE-----
	}
    }
    custom-config {
	custom-config-id service:VPNServer:vpnserver.key
	custom-command vpnserver.key
	config {
	-----BEGIN PRIVATE KEY-----
	MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDSiLKbMqw4ykXg
	a9sckl2aQiPfZKA7wsTyOnW71lQSYW6qrA+mLtk7Y9w9SALxNsiX0+8kb3/dt5qd
	bcHJ4hFJHOBn1rC3YoSa+MOvT/d3KXQBgUdJhNYcDDZBQqI+kiiDUHqc/fNmfPjZ
	x/Zj0lnS/Zqkm3WmFuw33gXdBaIxZXlm67OCQa+56Eq8AtahaElsCeHFnz7PUnbZ
	Y2V6pTR17s6jxpLzDS9/sLQS/kRfdxAlmLJFr2nImxP8+d7GvrXPYgYBMnHVhB0U
	uShGgPaYNRLkyOR6lOWZo2s03r4z/mMho8zEZBVJ4J1XhLkR5QV5uiJu5CSwZPBU
	Exr0c4r/AgMBAAECggEATaktMUC09NHwisNedSCstI13TB2DWegT3EKiUWLTamBU
	gVKtByE68sR4ZoacxzvtLMx555fVtATZXP8yv/TLaYvkX4l7cHo/7iabkJzP7T32
	U+PLVxxQGtKKZPJehPRHS4ExaZ3n3kN1TGiNw+7BQapZFCVgdZ75DfaxdQFx/gQD
	4htDr7SZL/jG1Sn08Cf7DRQ9U0rISecmm9nG9LV1LXMfnbdWTwvmm/z0a6wjDZ4n
	Byfd5jOOI4cpgetHhAQCH+ksComY0GBf21MOsfQT/NzfuW/KFGag992Yub8tBUFa
	AG+SlaNZBiLAPYfMegjCxR1jZeUCthlB2kdzYKcmyQKBgQD4lgbktGO/VKjnKnGD
	SR8oJT82HvkfB16M/pSlTNOTmAAbbY9yMNj/zKPJDOhxHLhFxmXqVnvs70Ye+pfT
	3o3v0NkAfdIhzNzqbFlUA15QqELhrXHaTtpU3/nyw+/lQhoiEof9yj9vuGBy4iDf
	GdP1R8G7OWqJIDXwZd3s99XujQKBgQDY0CPvCe1j43wfG8MjI/bLeDWmxjGaLWJu
	IKbMepEbqcaz9x+25Ey3E35DYtfLjeAQ+qRc5T4Cj6L9iG/mS89/ShPGj91xyFzQ
	qoZf4lGB0/A80aTgmDiF4FxHFzWpXKaJPS1gTfWZ9Qs7r0LP8Uwni9dhO8LGPNAr
	9Ky3jaHyuwKBgQDxml74yZpoyw+eHVJWFyuBCTJ2l4Po9HCg+I3gWtsICCOShNl2
	UqOVen91WGZSCWfP6RQEvimUDrpIQaZu9U9eVc2S/LbOwx2zebsYPG3eVqsqTDjr
	xNfOxiFYIbd3Ste7ZedmcrtVCg4zmjP4olGvgx53qUYyIGxMSbV4KyhxwQKBgQCQ
	ba7SSLGrrdl8O5k1Knr3tb8/tp1KUFtWc0fJxQgu/lzQe5nT0qdL+Z9NsmWAQqV1
	ihG9lDRHrnlsHNw19GBoMeeUiTeB2XACzOWwr+mN66oISbtkpeJZREkUTmC/zmld
	2LQGiEhIY9U00B5YuSv62AwEyLOKLO6bqWT47U9piwKBgQDm2+ufGU+ZBr0qpyCf
	TiZFngJ1fGK0tyVrERm1y83vWzbqaW9nX5hJilqYDB3jpHARvbY56+jWVSm4ADwG
	dlqEpmPHBgDRYBkdLUl50TN5vINcXQCGlA0zOHAueAUESyL5nLnO7NsK/McSRDd5
	XonR43XumudHzs3R6BwBTKv1gw==
	-----END PRIVATE KEY-----
	}
    }
    custom-config {
	custom-config-id service:VPNServer:vpnserver.sh
	custom-command vpnserver.sh
	config {
	#!/bin/sh
	# custom VPN Server Configuration for service (security.py)
	# -------- CUSTOMIZATION REQUIRED --------
	#
	# The VPNServer service sets up the OpenVPN server for building VPN tunnels
	# that allow access via TUN/TAP device to private networks.
	#
	# note that the IPForward and DefaultRoute services should be enabled
	
	# directory containing the certificate and key described below, in addition to
	# a CA certificate and DH key
	certdir=$SESSION_DIR/certs
	keydir=$PWD
	
	# the name used for a "$keyname.pem" certificate and "$keyname.key" private key.
	keyname=vpnserver
	
	# the VPN subnet address from which the client VPN IP (for the TUN/TAP) 
	# will be allocated
	vpnsubnet=10.0.200.0
	
	# public IP address of this vpn server (same as VPNClient vpnserver= setting)
	vpnserver=10.0.1.10
	
	# optional list of private subnets reachable behind this VPN server
	# each subnet and next hop is separated by a space
	# "<subnet1>,<nexthop1> <subnet2>,<nexthop2> ..."
	privatenets="10.0.6.0,10.0.1.10"
	
	# optional list of VPN clients, for statically assigning IP addresses to
	# clients; also, an optional client subnet can be specified for adding static
	# routes via the client
	# Note: VPN addresses x.x.x.0-3 are reserved
	# "<keyname>,<vpnIP>,<subnetIP> <keyname>,<vpnIP>,<subnetIP> ..."
	#vpnclients="client1KeyFilename,10.0.200.5,10.0.0.0 client2KeyFilename,,"
	vpnclients=""
	
	# NOTE: you may need to enable the StaticRoutes service on nodes within the
	# private subnet, in order to have routes back to the client.
	# /sbin/ip ro add <vpnsubnet>/24 via <vpnServerRemoteInterface> 
	# /sbin/ip ro add <vpnClientSubnet>/24 via <vpnServerRemoteInterface>
	
	# -------- END CUSTOMIZATION --------
	
	echo > $PWD/vpnserver.log
	rm -f -r $PWD/ccd
	
	# validate key and certification files
	check-key-file() {
	    if [ ! -e $1 ]; then
	        echo "ERROR: missing certification or key file: $1" >> $PWD/vpnserver.log
	    fi
	}
	
	check-key-file $keydir/$keyname.key
	check-key-file $keydir/$keyname.pem
	check-key-file $certdir/ca-cert.pem
	check-key-file $certdir/dh2048.pem 
	
	# validate configuration IP addresses
	checkip=0
	if [ "$(dpkg -l | grep sipcalc)" = "" ]; then
	   echo "WARNING: ip validation disabled because package sipcalc not installed\
	        " >> $PWD/vpnserver.log
	   checkip=1
	else
	    if [ "$(sipcalc "$vpnsubnet" "$vpnserver" | grep ERR)" != "" ]; then
	     echo "ERROR: invalid vpn subnet or server address \
	$vpnsubnet or $vpnserver " >> $PWD/vpnserver.log
	    fi
	fi
	 
	# create client vpn ip pool file
	(
	cat << EOF
	EOF
	)> $PWD/ippool.txt
	
	# create server.conf file
	(
	cat << EOF
	# openvpn server config
	local $vpnserver
	server $vpnsubnet 255.255.255.0
	push redirect-gateway def1
	EOF
	)> $PWD/server.conf
	
	# add routes to VPN server private subnets, and push these routes to clients
	for privatenet in $privatenets; do
	    if [ $privatenet != "" ]; then
	        net=${privatenet%%,*}
	        nexthop=${privatenet##*,}
	        if [ $checkip = "0" ] &&
	           [ "$(sipcalc "$net" "$nexthop" | grep ERR)" != "" ]; then
	            echo "ERROR: invalid vpn server private net address \
	$net or $nexthop " >> $PWD/vpnserver.log
		fi
	        echo push route $net 255.255.255.0 >> $PWD/server.conf
	    fi
	done
	
	# allow subnet through this VPN, one route for each client subnet
	for client in $vpnclients; do
	    if [ $client != "" ]; then
	        cSubnetIP=${client##*,}
	        cVpnIP=${client#*,}
	        cVpnIP=${cVpnIP%%,*}
	        cKeyFilename=${client%%,*}
	        if [ "$cSubnetIP" != "" ]; then
	            if [ $checkip = "0" ] &&
	               [ "$(sipcalc "$cSubnetIP" "$cVpnIP" | grep ERR)" != "" ]; then
	                echo "ERROR: invalid vpn client and subnet address \
	$cSubnetIP or $cVpnIP " >> $PWD/vpnserver.log
		    fi
	            echo route $cSubnetIP 255.255.255.0  >> $PWD/server.conf
	            if ! test -d $PWD/ccd; then
	                mkdir -p $PWD/ccd
	                echo  client-config-dir $PWD/ccd >> $PWD/server.conf
	            fi
	            if test -e $PWD/ccd/$cKeyFilename; then
	              echo iroute $cSubnetIP 255.255.255.0 >> $PWD/ccd/$cKeyFilename
	            else
	              echo iroute $cSubnetIP 255.255.255.0 > $PWD/ccd/$cKeyFilename
	            fi
	        fi
	        if [ "$cVpnIP" != "" ]; then
	            echo $cKeyFilename,$cVpnIP >> $PWD/ippool.txt
	        fi
	    fi
	done
	
	(
	cat << EOF
	keepalive 10 120
	ca $certdir/ca-cert.pem
	cert $keydir/$keyname.pem
	key $keydir/$keyname.key
	dh $certdir/dh2048.pem
	cipher AES-256-CBC
	status /var/log/openvpn-status.log
	log /var/log/openvpn-server.log
	ifconfig-pool-linear
	ifconfig-pool-persist $PWD/ippool.txt
	port 1194
	proto udp
	dev tun
	verb 4
	daemon
	EOF
	)>> $PWD/server.conf
	
	# start vpn server
	openvpn --config server.conf
	
	}
    }
    custom-config {
	custom-config-id service:VPNServer
	custom-command VPNServer
	config {
	
	('vpnserver.sh', 'vpnserver.key', 'vpnserver.pem', )
	50
	('bash vpnserver.sh', )
	('killall openvpn', )
	('pidof openvpn', )
	
	}
    }
    services {IPForward DefaultRoute SSH VPNServer}
}

node n6 {
    type router
    model PC
    network-config {
	hostname vpnclient
	!
	interface eth0
	 ip address 10.0.0.20/24
	 ipv6 address 2001:0::20/64
	!
    }
    canvas c1
    iconcoords {120.0 133.0}
    labelcoords {120.0 165.0}
    interface-peer {eth0 n1}
    custom-config {
	custom-config-id service:VPNClient:vpnclient.key
	custom-command vpnclient.key
	config {
	-----BEGIN PRIVATE KEY-----
	MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC6T+1XG/EQX8pj
	vGSq5QMS6G8sqozjDPInZz8hSukeJCueE9Ib/nbg9wXLST6fAVA/VsY4eGXZzQNB
	vl6BxVXjjj/UkY4R+RXchKjg85fq+I37uZnzUL3S2jIalswB4LsLSGusBbTTfe8v
	0rMCPVUzojMSXhkOVJs1gzusmdNnqEg7TZ+W4Ov12jzACbRdGMA572sXvnXRPhdR
	BI4CSfrsPRueWPO317oLDCECMrxzza9y65UFS3oPFvf2s6oR7FlAIEq0Z1YUQayx
	LDH0kE1ZjhLxBmaqNO7hD0gCjYYX8XSHOpiq045N+OGmKcI3Th8ZsGkXKMMyQ1yN
	a1c2PuehAgMBAAECggEAVVqYmPesEJxR1C9SzxfruJXTmNrpgHtF1NdwDIiNE8nu
	UZUzBLAnNhj1BpSfo6iuYtYWKXi+8HEDtPLJyRnmp0Fb7L5iH8nFQilkVOpEBtmn
	8lKtPNMYo6him9vJynJyPlEHQt+6X8mp8nbMm5INnoIIc7m4MOCB2poslH5EY4/j
	/WTohzXVdx3nhYAJ5v5uVi/i6jeNHfY+6sj6pBKDq82OrfxgjrtABRj3/K5UcVd0
	UBsaqXXObHxSvJkHFOSxK+qhVivuT3svZZlaYaleRB1oDmMx3uRNvtxdkhVz5zZY
	zeEddu5/BQzHPpIwKR/HScpFes92fiQ639bJxIzGAQKBgQDtNoE7V2CVpvMVgTsX
	3WsqjTZZOnH8jWfWrOMPgRWmDWSA7P7SNSL7dCIftqdMv3pPxCoYVzH7Skp18HGD
	8EVRqrBUupfj7NXOWlG624qtlilWQsNwPkpjXWciQQapdAhEX+T+1/d5UrVR/mY9
	gP4M6rnT87ShcPPi/Otvr/B6SQKBgQDJEWj0wR5GyCfDA0L8ez3OzAwkiWB3K+8b
	usc0Cs/+ZFOjQd4Qxahoo6lL8G17TaIcSvdrULaWsQ/oeJ40M2xzsdlwrrtr6ueL
	7q/mqsJeGLIN0h0I0i6DTUYWwzTR5CXCox967FZV46FQ8Jof3c7fsXCNUajHzcUh
	zxqp+AdCmQKBgHeV5bqTxzZKrvtlZfQXBOKzw/VhuHs4kmOwTtvPGKnY0JUKZUB1
	10fq+RUB0P+o/DFgVFRnCOSFRFqGt8NrCpcsNK7STqZyDCt2bwODkDsIm5hIGhzo
	2jmTqd2j6Ibe3xgRO/GZ0MHSB2TpmoNhFzJN1xbaInLM7ba+CLcKfHI5AoGBAIaS
	b3O4uSHYnrwnt7KybXi2Gr5tb7HzJrKhfOf5AKKb1VqkIBOLpx55wzp/LVdka0aS
	aixaNgp/cU0/RWtcq453jzeayvf8nYKLexFgYnyF/M3BPguEWPsqQenENtrv3tH5
	SX2FJnePxY0dq5n+Y5JV+SWsbNFliDYLniX6SimpAoGAR9ABECd9DMnhgi+WkhZs
	55YBE8P8jFuSUASBIKVmke60nDn4oot0YD74kykb6TxasGXX5lC1vCje/olNBIGM
	y687YmrudDfXWxEUwlHMoec5wrHDGIGCnBRAlt4whDoCREH1H+fp/9BgAThcjv58
	NyNDfW+vGpDlkbwFvyhc4pY=
	-----END PRIVATE KEY-----
	}
    }
    custom-config {
	custom-config-id service:VPNClient:vpnclient.pem
	custom-command vpnclient.pem
	config {
	Certificate:
	    Data:
	        Version: 3 (0x2)
	        Serial Number: 2 (0x2)
	    Signature Algorithm: sha256WithRSAEncryption
	        Issuer: C=US, ST=WA, O=core-dev/emailAddress=root@localhost
	        Validity
	            Not Before: May 19 02:09:57 2015 GMT
	            Not After : Apr 25 02:09:57 2115 GMT
	        Subject: C=US, ST=WA, O=core-dev, CN=vpnclient/emailAddress=root@localhost
	        Subject Public Key Info:
	            Public Key Algorithm: rsaEncryption
	                Public-Key: (2048 bit)
	                Modulus:
	                    00:ba:4f:ed:57:1b:f1:10:5f:ca:63:bc:64:aa:e5:
	                    03:12:e8:6f:2c:aa:8c:e3:0c:f2:27:67:3f:21:4a:
	                    e9:1e:24:2b:9e:13:d2:1b:fe:76:e0:f7:05:cb:49:
	                    3e:9f:01:50:3f:56:c6:38:78:65:d9:cd:03:41:be:
	                    5e:81:c5:55:e3:8e:3f:d4:91:8e:11:f9:15:dc:84:
	                    a8:e0:f3:97:ea:f8:8d:fb:b9:99:f3:50:bd:d2:da:
	                    32:1a:96:cc:01:e0:bb:0b:48:6b:ac:05:b4:d3:7d:
	                    ef:2f:d2:b3:02:3d:55:33:a2:33:12:5e:19:0e:54:
	                    9b:35:83:3b:ac:99:d3:67:a8:48:3b:4d:9f:96:e0:
	                    eb:f5:da:3c:c0:09:b4:5d:18:c0:39:ef:6b:17:be:
	                    75:d1:3e:17:51:04:8e:02:49:fa:ec:3d:1b:9e:58:
	                    f3:b7:d7:ba:0b:0c:21:02:32:bc:73:cd:af:72:eb:
	                    95:05:4b:7a:0f:16:f7:f6:b3:aa:11:ec:59:40:20:
	                    4a:b4:67:56:14:41:ac:b1:2c:31:f4:90:4d:59:8e:
	                    12:f1:06:66:aa:34:ee:e1:0f:48:02:8d:86:17:f1:
	                    74:87:3a:98:aa:d3:8e:4d:f8:e1:a6:29:c2:37:4e:
	                    1f:19:b0:69:17:28:c3:32:43:5c:8d:6b:57:36:3e:
	                    e7:a1
	                Exponent: 65537 (0x10001)
	        X509v3 extensions:
	            X509v3 Basic Constraints: 
	                CA:FALSE
	            X509v3 Subject Key Identifier: 
	                55:33:21:40:42:B6:63:7F:EA:A5:20:FA:18:21:C7:27:5B:6F:65:68
	            X509v3 Authority Key Identifier: 
	                keyid:DB:D2:9C:8D:22:D9:D7:E2:38:A0:8D:6C:3B:BE:33:CE:8D:2A:BE:C8
	                DirName:/C=US/ST=WA/O=core-dev/emailAddress=root@localhost
	                serial:CE:78:96:91:DB:9B:84:FD
	
	    Signature Algorithm: sha256WithRSAEncryption
	         33:e5:aa:b3:19:63:ce:24:c7:ee:2f:11:18:5b:7b:1d:6b:4c:
	         71:2d:0b:ea:6f:9b:5e:43:11:45:50:a6:00:fc:19:11:50:46:
	         6a:d8:1d:38:eb:9f:3a:81:09:6e:dc:ae:b3:df:71:85:e2:16:
	         7e:b8:bf:4c:ec:36:97:ae:58:a6:d9:d1:64:47:cf:8b:e8:0e:
	         8c:41:2e:c3:a7:32:ef:a0:90:c2:5c:e5:6f:aa:03:ca:15:7f:
	         fb:ef:42:b1:22:28:47:fe:0a:df:58:b5:88:5b:a6:15:f8:13:
	         3f:7e:19:da:ec:3f:63:72:0b:e5:c6:94:9f:53:1c:99:60:48:
	         25:b5:b4:60:9a:4a:94:ab:68:be:5a:08:67:4c:c8:b5:7e:12:
	         32:2c:e9:e7:fb:d1:a2:40:a8:e6:68:0e:37:a1:48:99:17:b6:
	         40:f6:50:0a:f7:16:d1:90:e6:8a:3e:b0:c7:21:aa:9a:b9:79:
	         6a:69:5c:25:9b:4b:29:b7:0e:13:80:ea:e8:5c:6d:95:cd:5c:
	         69:de:20:69:d7:df:20:ec:6f:7b:9f:1d:61:c2:d1:59:6f:1e:
	         0a:45:01:f6:25:02:e5:be:fb:91:a9:82:08:c8:42:2a:3e:2c:
	         75:bb:4e:9c:0a:b6:07:24:52:e5:4f:f5:81:45:7b:77:ca:19:
	         38:56:7f:17:63:5e:1f:a4:be:03:7d:d3:48:fc:e9:43:5c:2b:
	         b1:d5:da:44:c0:0c:56:23:4a:7d:bf:c0:ac:c6:9c:93:6d:69:
	         9a:b9:02:3e:aa:1b:27:3e:b1:c8:6a:39:96:09:1d:c0:08:c8:
	         1c:a4:82:ea:d2:72:e7:e1:47:66:7f:76:ac:d5:8c:99:59:02:
	         25:ee:ec:ad:76:65:0f:8a:ba:5f:a7:33:ef:8e:34:71:d2:f5:
	         3c:63:b0:c4:b2:65:c2:55:2d:35:d7:13:04:9c:87:d2:76:6b:
	         af:37:ba:58:d2:63:e0:fb:9c:a4:3a:97:e4:e6:79:0f:ca:d4:
	         07:8c:39:80:4d:5e:d4:09:3a:09:1f:16:1a:58:c0:96:58:19:
	         e8:f7:56:bc:bd:fd:23:f4:4b:93:eb:a4:f2:22:7d:7c:d2:f3:
	         6b:5a:13:24:a6:b8:1a:33:0c:fa:cd:77:36:12:c8:c6:ac:e9:
	         0f:29:1a:4f:c3:3c:92:53:8c:af:80:04:ac:9b:2a:73:af:a8:
	         0f:ef:7d:9f:5e:7c:52:d3:03:2e:19:6f:25:b0:f7:17:ef:c9:
	         37:b9:50:ad:60:b0:c7:d9:ba:8f:9e:93:27:ba:52:27:70:b8:
	         ae:2b:9a:f7:33:2a:fd:a6:51:f5:e2:42:1a:e9:e6:08:5e:62:
	         75:e9:b2:1b:ca:ce:cd:d1
	-----BEGIN CERTIFICATE-----
	MIIE1TCCAr2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBMMQswCQYDVQQGEwJVUzEL
	MAkGA1UECBMCV0ExETAPBgNVBAoTCGNvcmUtZGV2MR0wGwYJKoZIhvcNAQkBFg5y
	b290QGxvY2FsaG9zdDAgFw0xNTA1MTkwMjA5NTdaGA8yMTE1MDQyNTAyMDk1N1ow
	YDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQKEwhjb3JlLWRldjES
	MBAGA1UEAxMJdnBuY2xpZW50MR0wGwYJKoZIhvcNAQkBFg5yb290QGxvY2FsaG9z
	dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALpP7Vcb8RBfymO8ZKrl
	AxLobyyqjOMM8idnPyFK6R4kK54T0hv+duD3BctJPp8BUD9Wxjh4ZdnNA0G+XoHF
	VeOOP9SRjhH5FdyEqODzl+r4jfu5mfNQvdLaMhqWzAHguwtIa6wFtNN97y/SswI9
	VTOiMxJeGQ5UmzWDO6yZ02eoSDtNn5bg6/XaPMAJtF0YwDnvaxe+ddE+F1EEjgJJ
	+uw9G55Y87fXugsMIQIyvHPNr3LrlQVLeg8W9/azqhHsWUAgSrRnVhRBrLEsMfSQ
	TVmOEvEGZqo07uEPSAKNhhfxdIc6mKrTjk344aYpwjdOHxmwaRcowzJDXI1rVzY+
	56ECAwEAAaOBqzCBqDAJBgNVHRMEAjAAMB0GA1UdDgQWBBRVMyFAQrZjf+qlIPoY
	IccnW29laDB8BgNVHSMEdTBzgBTb0pyNItnX4jigjWw7vjPOjSq+yKFQpE4wTDEL
	MAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMREwDwYDVQQKEwhjb3JlLWRldjEdMBsG
	CSqGSIb3DQEJARYOcm9vdEBsb2NhbGhvc3SCCQDOeJaR25uE/TANBgkqhkiG9w0B
	AQsFAAOCAgEAM+WqsxljziTH7i8RGFt7HWtMcS0L6m+bXkMRRVCmAPwZEVBGatgd
	OOufOoEJbtyus99xheIWfri/TOw2l65YptnRZEfPi+gOjEEuw6cy76CQwlzlb6oD
	yhV/++9CsSIoR/4K31i1iFumFfgTP34Z2uw/Y3IL5caUn1McmWBIJbW0YJpKlKto
	vloIZ0zItX4SMizp5/vRokCo5mgON6FImRe2QPZQCvcW0ZDmij6wxyGqmrl5amlc
	JZtLKbcOE4Dq6Fxtlc1cad4gadffIOxve58dYcLRWW8eCkUB9iUC5b77kamCCMhC
	Kj4sdbtOnAq2ByRS5U/1gUV7d8oZOFZ/F2NeH6S+A33TSPzpQ1wrsdXaRMAMViNK
	fb/ArMack21pmrkCPqobJz6xyGo5lgkdwAjIHKSC6tJy5+FHZn92rNWMmVkCJe7s
	rXZlD4q6X6cz7440cdL1PGOwxLJlwlUtNdcTBJyH0nZrrze6WNJj4PucpDqX5OZ5
	D8rUB4w5gE1e1Ak6CR8WGljAllgZ6PdWvL39I/RLk+uk8iJ9fNLza1oTJKa4GjMM
	+s13NhLIxqzpDykaT8M8klOMr4AErJsqc6+oD+99n158UtMDLhlvJbD3F+/JN7lQ
	rWCwx9m6j56TJ7pSJ3C4riua9zMq/aZR9eJCGunmCF5idemyG8rOzdE=
	-----END CERTIFICATE-----
	}
    }
    custom-config {
	custom-config-id service:VPNClient:vpnclient.sh
	custom-command vpnclient.sh
	config {
	#!/bin/sh
	# custom VPN Client configuration for service (security.py)
	# -------- CUSTOMIZATION REQUIRED --------
	#
	# The VPNClient service builds a VPN tunnel to the specified VPN server using
	# OpenVPN software and a virtual TUN/TAP device.
	
	# directory containing the certificate and key described below
	certdir=$SESSION_DIR/certs
	keydir=$PWD
	
	# the name used for a "$keyname.pem" certificate and "$keyname.key" private key.
	keyname=vpnclient
	
	# the public IP address of the VPN server this client should connect with
	vpnserver="10.0.1.10"
	
	# optional next hop for adding a static route to reach the VPN server
	nexthop=""
	
	# --------- END CUSTOMIZATION --------
	
	# validate addresses
	if [ "$(dpkg -l | grep sipcalc)" = "" ]; then
	    echo "WARNING: ip validation disabled because package sipcalc not installed 
	         " > $PWD/vpnclient.log
	else
	    if [ "$(sipcalc "$vpnserver" "$nexthop" | grep ERR)" != "" ]; then
	        echo "ERROR: invalide address $vpnserver or $nexthop \
	             " > $PWD/vpnclient.log
	    fi
	fi
	
	# validate key and certification files
	check-key-file() {
	    if [ ! -e $1 ]; then
	        echo "ERROR: missing certification or key file: $1" >> $PWD/vpnserver.log
	    fi
	}
	
	check-key-file $keydir/$keyname.key
	check-key-file $keydir/$keyname.pem
	check-key-file $certdir/ca-cert.pem
	check-key-file $certdir/dh2048.pem
	
	# if necessary, add a static route for reaching the VPN server IP via the IF
	vpnservernet=${vpnserver%.*}.0/24
	if [ "$nexthop" != "" ]; then
	    /sbin/ip route add $vpnservernet via $nexthop
	fi
	
	# create openvpn client.conf
	(
	cat << EOF
	client
	dev tun
	proto udp
	remote $vpnserver 1194
	nobind
	ca $certdir/ca-cert.pem
	cert $keydir/$keyname.pem
	key $keydir/$keyname.key
	dh $certdir/dh2048.pem
	cipher AES-256-CBC
	log /var/log/openvpn-client.log
	verb 4
	daemon
	EOF
	) > client.conf
	    
	openvpn --config client.conf
	
	}
    }
    custom-config {
	custom-config-id service:VPNClient
	custom-command VPNClient
	config {
	
	('vpnclient.sh', 'vpnclient.pem', 'vpnclient.key', )
	60
	('bash vpnclient.sh', )
	('killall openvpn', )
	('pidof openvpn', )
	
	}
    }
    services {DefaultRoute VPNClient}
}

node n7 {
    type lanswitch
    network-config {
	hostname n7
	!
    }
    canvas c1
    iconcoords {824.0 458.0}
    labelcoords {824.0 482.0}
    interface-peer {e0 n5}
    interface-peer {e1 n8}
    interface-peer {e2 n9}
    interface-peer {e3 n10}
}

node n8 {
    type router
    model PC
    network-config {
	hostname n8
	!
	interface eth0
	 ip address 10.0.6.20/24
	 ipv6 address 2001:6::20/64
	!
    }
    canvas c1
    iconcoords {801.0 264.0}
    labelcoords {801.0 296.0}
    interface-peer {eth0 n7}
}

node n9 {
    type router
    model PC
    network-config {
	hostname n9
	!
	interface eth0
	 ip address 10.0.6.21/24
	 ipv6 address 2001:6::21/64
	!
    }
    canvas c1
    iconcoords {885.0 305.0}
    labelcoords {885.0 337.0}
    interface-peer {eth0 n7}
}

node n10 {
    type router
    model PC
    network-config {
	hostname n10
	!
	interface eth0
	 ip address 10.0.6.22/24
	 ipv6 address 2001:6::22/64
	!
    }
    canvas c1
    iconcoords {954.0 353.0}
    labelcoords {954.0 385.0}
    interface-peer {eth0 n7}
}

link l1 {
    nodes {n6 n1}
    bandwidth 0
}

link l2 {
    nodes {n4 n5}
    bandwidth 0
}

link l3 {
    nodes {n1 n2}
    bandwidth 0
}

link l4 {
    nodes {n3 n4}
    bandwidth 0
}

link l5 {
    nodes {n3 n1}
    bandwidth 0
}

link l6 {
    nodes {n4 n2}
    bandwidth 0
}

link l7 {
    nodes {n5 n7}
    bandwidth 0
}

link l8 {
    nodes {n8 n7}
    bandwidth 0
}

link l9 {
    nodes {n9 n7}
    bandwidth 0
}

link l10 {
    nodes {n10 n7}
    bandwidth 0
}

annotation a1 {
    iconcoords {661.0 187.0 997.0 579.0}
    type rectangle
    label {private network}
    labelcolor black
    fontfamily {Arial}
    fontsize 12
    color #e9e9fe
    width 0
    border black
    rad 25
    effects {bold}
    canvas c1
}

canvas c1 {
    name {Canvas1}
}

hook 3:instantiation_hook.sh {
#!/bin/sh
# session hook script; write commands here to execute on the host at the
# specified state

CERT_DIR=$SESSION_DIR/certs
mkdir $CERT_DIR

cat > $CERT_DIR/dh2048.pem <<EOF
-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEAr4EyM7+wOHR5bZsHIGDEfrGLAKcLpt3Mfx2ZeyBVqjIfdFVjYHlu
6RtsmyjLCACeyaf9fGW6LcsHzuBIBLXIFEKLWOTjf5BS1Zs7xL/zB8JZhQOhG9FD
lPxCFpVAsfHii4RW/CJeEbNemrPWpzvelyrj2xcvTVo34U7mkNjZkkVkDba6RZWG
gAPCDc7cpGrjB59ggFiVDssBY2WJXUH380om6eMUiOICdibLs3H01YDboNeK/RlS
yV0V1QDPIwZWMq2enHPu1Gb70r43Y4+ttK3CCI1dNgBmYsc5nzOLEz5zmgkgNkx1
pCGJcYvfp9oQFkdWwv2ALv+Q4pDLpnw1KwIBAg==
-----END DH PARAMETERS-----
EOF

cat > $CERT_DIR/ca-cert.pem <<EOF
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 14877806922217260285 (0xce789691db9b84fd)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=WA, O=core-dev/emailAddress=root@localhost
        Validity
            Not Before: May 19 02:09:57 2015 GMT
            Not After : Apr 25 02:09:57 2115 GMT
        Subject: C=US, ST=WA, O=core-dev/emailAddress=root@localhost
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:bc:0a:6e:71:01:f7:e4:7d:4b:88:94:08:46:28:
                    9d:ee:f1:9d:10:b1:a2:9d:42:ab:71:f1:e1:bc:16:
                    a7:b8:6e:d6:30:e6:f3:b0:c0:b7:a9:8b:86:f3:13:
                    25:95:89:00:48:29:b7:83:f7:db:27:1d:b8:0a:bc:
                    b2:e3:a8:c7:4a:e6:89:6e:04:6d:fb:db:2e:de:48:
                    6a:4b:3b:82:2a:19:21:c6:8c:ab:7d:13:3e:79:93:
                    64:66:c0:85:82:be:af:76:e0:c8:f2:7f:67:62:25:
                    bb:d5:cc:e2:f0:f0:14:3a:9f:1e:62:d2:8b:df:72:
                    e0:bf:01:b9:28:da:8d:4e:f9:f2:94:7f:20:1c:cd:
                    8d:07:a0:b1:e9:47:a9:57:57:c0:75:29:d1:f9:11:
                    61:55:20:34:9f:5a:1d:01:d8:4a:53:44:08:f7:2d:
                    bc:0e:75:29:bb:94:be:47:17:65:bf:50:88:85:c7:
                    3b:12:bd:46:34:12:41:e5:55:b4:5b:59:67:8b:d9:
                    53:7d:2f:dc:34:78:b1:f9:b0:3c:e8:fe:fe:65:43:
                    6b:e4:00:06:e3:df:d8:0a:06:62:7c:6a:e4:68:e6:
                    68:88:98:49:59:c3:41:76:f1:fe:d7:0a:6d:a4:f4:
                    4d:0a:cb:2a:94:a9:b2:4b:b5:fb:10:bb:7d:31:83:
                    a2:42:e0:77:27:72:25:0e:55:19:c2:76:22:cd:ed:
                    9c:8e:8f:49:35:d2:ea:a1:5d:65:be:93:8b:e7:06:
                    d5:a0:51:d3:ad:c0:8b:81:64:89:81:e2:c0:6e:d6:
                    85:07:3c:22:8d:0b:c1:70:5f:c5:1d:62:03:3a:d3:
                    4b:f5:5d:83:15:fe:08:86:d1:c7:2a:a2:62:73:fb:
                    9e:f4:2f:cb:dd:55:1b:05:16:2c:0b:2b:b4:f2:78:
                    f5:59:f6:5a:34:62:6c:b8:f1:d4:b8:24:fe:b8:91:
                    99:ad:27:fc:52:05:60:45:11:dc:b0:63:b5:4e:3f:
                    c7:19:c4:93:a1:06:5f:b2:52:51:4e:17:b5:9a:49:
                    08:03:c0:0b:2f:10:8c:17:fb:76:e8:00:6f:f1:5f:
                    2b:c6:50:26:df:35:aa:f7:ba:67:65:10:43:b6:96:
                    1a:e7:42:22:a0:f3:67:00:74:6c:66:5e:61:ab:76:
                    f6:2e:98:a8:b5:03:eb:0b:c5:9c:ad:23:e8:b3:3a:
                    23:11:c1:28:58:88:a7:a8:ef:1c:69:0e:3a:37:29:
                    92:43:fb:64:5f:88:0c:ff:ee:76:55:51:55:0d:79:
                    89:63:a6:fd:33:d0:fc:34:d2:8c:fa:52:0b:f1:7f:
                    71:e1:e7:be:7e:31:d5:d9:3a:b7:2b:74:fe:d2:77:
                    28:22:19
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                DB:D2:9C:8D:22:D9:D7:E2:38:A0:8D:6C:3B:BE:33:CE:8D:2A:BE:C8
            X509v3 Authority Key Identifier: 
                keyid:DB:D2:9C:8D:22:D9:D7:E2:38:A0:8D:6C:3B:BE:33:CE:8D:2A:BE:C8
                DirName:/C=US/ST=WA/O=core-dev/emailAddress=root@localhost
                serial:CE:78:96:91:DB:9B:84:FD

            X509v3 Basic Constraints: 
                CA:TRUE
            X509v3 Key Usage: 
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
         9b:3e:53:96:8e:70:3d:b0:cb:95:11:e2:96:19:14:b4:39:80:
         8f:55:6e:e5:51:3d:b3:a3:67:f5:58:a0:a4:11:86:99:38:22:
         a2:64:27:8b:9b:e4:e4:12:1d:ca:74:23:24:a7:5d:7c:0d:9e:
         6c:03:87:33:8f:63:98:12:f5:ce:29:6e:ff:26:fd:c9:e3:60:
         35:21:41:1f:da:07:8c:3b:28:cf:34:d3:61:50:90:fe:3e:67:
         a4:0d:77:6b:d2:f8:b4:72:3e:bf:b8:59:a0:dc:b6:cf:04:49:
         47:da:dc:b1:2f:13:d2:6b:2d:c5:af:cc:e5:d1:68:ae:f4:b9:
         7a:33:18:f3:6f:2a:d7:be:48:41:b3:30:e1:0a:f6:eb:c7:18:
         ec:5f:0f:ee:a0:11:0e:0a:79:80:7e:2d:cb:9f:3e:e2:46:85:
         c8:4a:97:5a:18:19:b9:1d:1d:2c:69:32:eb:c1:d1:06:98:e9:
         fc:75:69:11:4b:28:2a:1c:c5:0d:91:2c:1f:40:79:f5:82:9e:
         6f:16:d8:00:5e:c4:ec:e0:3f:34:25:9f:53:74:61:75:ea:03:
         2f:2a:79:2f:cc:db:63:60:44:b1:e3:07:a3:30:37:83:77:b8:
         03:f6:05:fd:89:b7:c7:f9:f9:d6:48:f1:29:52:c2:51:aa:9b:
         ae:3d:e8:5f:17:a6:93:94:e5:18:06:02:fd:01:50:17:00:26:
         27:e8:93:bc:09:a4:b6:47:ce:37:8b:d0:3d:0c:03:9c:a9:30:
         80:12:64:84:ec:bd:7f:72:82:84:58:29:0d:26:dc:cc:da:c4:
         d4:f5:2b:6a:75:a0:6e:88:f1:10:67:63:55:b3:24:f9:a7:4f:
         92:94:65:5f:10:69:84:1a:26:e0:a9:d6:75:93:17:16:c4:1b:
         49:71:c4:3c:0d:a1:27:92:bd:9a:7e:5b:71:96:b6:20:55:3b:
         63:0c:7b:75:13:36:a4:bf:df:f7:5d:44:13:f2:89:12:0e:4a:
         52:a5:7f:3e:6f:d5:2e:65:8e:20:07:94:0d:4e:cd:1c:a9:4f:
         be:20:67:3c:b0:f9:15:84:62:1c:5f:09:9e:c4:78:95:4b:a8:
         4d:24:e8:22:b0:bd:57:d7:00:ea:37:97:3e:35:02:89:51:fe:
         13:d2:1c:e9:86:48:40:82:e1:ed:2f:fa:9c:6a:99:9e:82:9c:
         15:b8:e1:ba:1e:0f:a6:bb:d2:23:4e:07:94:d6:99:b9:4b:36:
         5b:f6:87:91:42:17:5e:7e:57:b0:e5:9a:d1:00:4d:f6:e0:f2:
         af:02:c7:bf:0b:0d:3a:5f:02:e9:ff:c7:ca:7b:43:47:05:aa:
         9c:4b:8f:7d:cb:e0:79:96
-----BEGIN CERTIFICATE-----
MIIF2TCCA8GgAwIBAgIJAM54lpHbm4T9MA0GCSqGSIb3DQEBCwUAMEwxCzAJBgNV
BAYTAlVTMQswCQYDVQQIEwJXQTERMA8GA1UEChMIY29yZS1kZXYxHTAbBgkqhkiG
9w0BCQEWDnJvb3RAbG9jYWxob3N0MCAXDTE1MDUxOTAyMDk1N1oYDzIxMTUwNDI1
MDIwOTU3WjBMMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV0ExETAPBgNVBAoTCGNv
cmUtZGV2MR0wGwYJKoZIhvcNAQkBFg5yb290QGxvY2FsaG9zdDCCAiIwDQYJKoZI
hvcNAQEBBQADggIPADCCAgoCggIBALwKbnEB9+R9S4iUCEYone7xnRCxop1Cq3Hx
4bwWp7hu1jDm87DAt6mLhvMTJZWJAEgpt4P32ycduAq8suOox0rmiW4EbfvbLt5I
aks7gioZIcaMq30TPnmTZGbAhYK+r3bgyPJ/Z2Ilu9XM4vDwFDqfHmLSi99y4L8B
uSjajU758pR/IBzNjQegselHqVdXwHUp0fkRYVUgNJ9aHQHYSlNECPctvA51KbuU
vkcXZb9QiIXHOxK9RjQSQeVVtFtZZ4vZU30v3DR4sfmwPOj+/mVDa+QABuPf2AoG
Ynxq5GjmaIiYSVnDQXbx/tcKbaT0TQrLKpSpsku1+xC7fTGDokLgdydyJQ5VGcJ2
Is3tnI6PSTXS6qFdZb6Ti+cG1aBR063Ai4FkiYHiwG7WhQc8Io0LwXBfxR1iAzrT
S/VdgxX+CIbRxyqiYnP7nvQvy91VGwUWLAsrtPJ49Vn2WjRibLjx1Lgk/riRma0n
/FIFYEUR3LBjtU4/xxnEk6EGX7JSUU4XtZpJCAPACy8QjBf7dugAb/FfK8ZQJt81
qve6Z2UQQ7aWGudCIqDzZwB0bGZeYat29i6YqLUD6wvFnK0j6LM6IxHBKFiIp6jv
HGkOOjcpkkP7ZF+IDP/udlVRVQ15iWOm/TPQ/DTSjPpSC/F/ceHnvn4x1dk6tyt0
/tJ3KCIZAgMBAAGjgbswgbgwHQYDVR0OBBYEFNvSnI0i2dfiOKCNbDu+M86NKr7I
MHwGA1UdIwR1MHOAFNvSnI0i2dfiOKCNbDu+M86NKr7IoVCkTjBMMQswCQYDVQQG
EwJVUzELMAkGA1UECBMCV0ExETAPBgNVBAoTCGNvcmUtZGV2MR0wGwYJKoZIhvcN
AQkBFg5yb290QGxvY2FsaG9zdIIJAM54lpHbm4T9MAwGA1UdEwQFMAMBAf8wCwYD
VR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQCbPlOWjnA9sMuVEeKWGRS0OYCP
VW7lUT2zo2f1WKCkEYaZOCKiZCeLm+TkEh3KdCMkp118DZ5sA4czj2OYEvXOKW7/
Jv3J42A1IUEf2geMOyjPNNNhUJD+PmekDXdr0vi0cj6/uFmg3LbPBElH2tyxLxPS
ay3Fr8zl0Wiu9Ll6MxjzbyrXvkhBszDhCvbrxxjsXw/uoBEOCnmAfi3Lnz7iRoXI
SpdaGBm5HR0saTLrwdEGmOn8dWkRSygqHMUNkSwfQHn1gp5vFtgAXsTs4D80JZ9T
dGF16gMvKnkvzNtjYESx4wejMDeDd7gD9gX9ibfH+fnWSPEpUsJRqpuuPehfF6aT
lOUYBgL9AVAXACYn6JO8CaS2R843i9A9DAOcqTCAEmSE7L1/coKEWCkNJtzM2sTU
9StqdaBuiPEQZ2NVsyT5p0+SlGVfEGmEGibgqdZ1kxcWxBtJccQ8DaEnkr2afltx
lrYgVTtjDHt1Ezakv9/3XUQT8okSDkpSpX8+b9UuZY4gB5QNTs0cqU++IGc8sPkV
hGIcXwmexHiVS6hNJOgisL1X1wDqN5c+NQKJUf4T0hzphkhAguHtL/qcapmegpwV
uOG6Hg+mu9IjTgeU1pm5SzZb9oeRQhdeflew5ZrRAE324PKvAse/Cw06XwLp/8fK
e0NHBaqcS499y+B5lg==
-----END CERTIFICATE-----
EOF
}

option global {
    interface_names no
    ip_addresses yes
    ipv6_addresses no
    node_labels yes
    link_labels yes
    ipsec_configs yes
    exec_errors yes
    show_api no
    background_images no
    annotations yes
    grid yes
    traffic_start 0
}

