/testing/guestbin/swan-prep --nokeys
Initializing NSS database
east #
 ipsec start
Redirecting to: [initsystem]
east #
 ../../guestbin/wait-until-pluto-started
east #
 echo "initdone"
initdone
east #
 # Grep east's log for all rate-limited UDP events and the limiter
east #
 # sentinel.
east #
 #
east #
 # Columns: plain RC_LOG lines start with 'packet from',
east #
 #          debug-stream (over-limit) lines start with '| ',
east #
 #          impair lines start with 'impair: '
east #
 DROPPED() { grep -e '^packet from' -e '^| dropping packet with mangled IKE header' -e '^impair: ' /tmp/pluto.log ; }
east #
 # ----------------------------------
east #
 # port 4500 (esp_encapsulation_enabled)
east #
 # ----------------------------------
east #
 ipsec restart
Redirecting to: [initsystem]
east #
 ../../guestbin/wait-until-pluto-started
east #
 ipsec whack --impair log_rate_limit:3 # suppress last
east #
 # iface_udp.c: "too small packet" - packet shorter than 4 bytes (sizeof uint32_t)
east #
 printf 'ab' | nc -4 -u 192.1.2.23 4500
east #
 # iface_udp.c: "has no Non-ESP marker" - first 4 bytes non-zero, no zero marker
east #
 printf '\x01\x02\x03\x04rest' | nc -4 -u 192.1.2.23 4500
east #
 # iface_udp.c: "mangled with potential spurious non-esp marker"
east #
 # valid Non-ESP marker (4 zero bytes) followed by NON_ESP_MARKER_SIZE more zero bytes
east #
 printf '\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0' | nc -4 -u 192.1.2.23 4500
east #
 # iface_udp.c: "NAT-T keep-alive" - single 0xff byte with Non-ESP marker prefix
east #
 printf '\0\0\0\0\xff' | nc -4 -u 192.1.2.23 4500
east #
 DROPPED
impair: log_rate_limit: no -> 3
packet from 192.1.2.23:EPHEM: too small packet (2)
packet from 192.1.2.23:EPHEM: has no Non-ESP marker
packet from 192.1.2.23:EPHEM: message digest rate limited log reached limit of 3 entries
packet from 192.1.2.23:EPHEM: mangled with potential spurious non-esp marker
east #
 # ----------------------------------
east #
 # port 500 (plain IKE, no esp_encapsulation)
east #
 # ----------------------------------
east #
 ipsec restart
Redirecting to: [initsystem]
east #
 ../../guestbin/wait-until-pluto-started
east #
 ipsec whack --impair log_rate_limit:2 # suppress last
east #
 # demux.c: "dropping packet with mangled IKE header" - under limit
east #
 printf '\0\0\0\0a' | nc -4 -u 192.1.2.23 500
east #
 # demux.c: at limit - sentinel fires here
east #
 printf '\0\0\0\0as' | nc -4 -u 192.1.2.23 500
east #
 # demux.c: over limit - suppressed to debug log
east #
 printf '\0\0\0\0asd' | nc -4 -u 192.1.2.23 500
east #
 DROPPED
impair: log_rate_limit: no -> 2
packet from 192.1.2.23:EPHEM: dropping packet with mangled IKE header: not enough room in input packet for ISAKMP Message (remain=5, sd->size=28)
packet from 192.1.2.23:EPHEM: message digest rate limited log reached limit of 2 entries
packet from 192.1.2.23:EPHEM: dropping packet with mangled IKE header: not enough room in input packet for ISAKMP Message (remain=6, sd->size=28)
| dropping packet with mangled IKE header: not enough room in input packet for ISAKMP Message (remain=7, sd->size=28)
east #
 # ----------------------------------
east #
 # disable loglimit - should ignore impair
east #
 # ----------------------------------
east #
 set -e 's/.*loglimit=.*/\tloglimit=no/' ipsec.conf > /etc/ipsec.conf
east #
 ipsec restart
Redirecting to: [initsystem]
east #
 ../../guestbin/wait-until-pluto-started
east #
 ipsec whack --impair log_rate_limit:1 # suppress last
east #
 # demux.c: "dropping packet with mangled IKE header" - under limit
east #
 printf '\0\0\0\0a' | nc -4 -u 192.1.2.23 500
east #
 # demux.c: at limit - sentinel ignored
east #
 printf '\0\0\0\0as' | nc -4 -u 192.1.2.23 500
east #
 DROPPED
impair: log_rate_limit: no -> 2
packet from 192.1.2.23:EPHEM: dropping packet with mangled IKE header: not enough room in input packet for ISAKMP Message (remain=5, sd->size=28)
packet from 192.1.2.23:EPHEM: message digest rate limited log reached limit of 2 entries
packet from 192.1.2.23:EPHEM: dropping packet with mangled IKE header: not enough room in input packet for ISAKMP Message (remain=6, sd->size=28)
| dropping packet with mangled IKE header: not enough room in input packet for ISAKMP Message (remain=7, sd->size=28)
east #
 # ----------------------------------
east #
 # disable loglimit - should ignore impair
east #
 # ----------------------------------
east #
 grep '^log rate' /tmp/pluto.log # default is loglimit=yes
log rate limiting [enabled]
east #
 sed -e 's/.*loglimit=.*/\tloglimit=yes/' ipsec.conf > /etc/ipsec.conf
east #
 ipsec stop
Redirecting to: [initsystem]
east #
 ipsec start
Redirecting to: [initsystem]
east #
 ../../guestbin/wait-until-pluto-started
east #
 grep '^log rate' /tmp/pluto.log
log rate limiting [enabled]
east #
 sed -e 's/.*loglimit=.*/\tloglimit=no/' ipsec.conf > /etc/ipsec.conf
east #
 ipsec restart
Redirecting to: [initsystem]
east #
 ../../guestbin/wait-until-pluto-started
east #
 grep '^log rate' /tmp/pluto.log
log rate limiting [disabled]
east #
 ipsec whack --impair log_rate_limit:1 # suppress last
east #
 # demux.c: "dropping packet with mangled IKE header" - under limit
east #
 printf '\0\0\0\0a' | nc -4 -u 192.1.2.23 500
east #
 # demux.c: at limit - sentinel ignored
east #
 printf '\0\0\0\0as' | nc -4 -u 192.1.2.23 500
east #
 # don't expect limiter
east #
 DROPPED
impair: log_rate_limit: no -> 1
packet from 192.1.2.23:EPHEM: dropping packet with mangled IKE header: not enough room in input packet for ISAKMP Message (remain=5, sd->size=28)
packet from 192.1.2.23:EPHEM: dropping packet with mangled IKE header: not enough room in input packet for ISAKMP Message (remain=6, sd->size=28)
east #
