testing: Let test scenarios fail if IPsec SAs or policies are not removed

The IKE daemon should delete all installed SAs and policies when
everything works properly, so we fail the test if that's not the case.

diff --git a/testing/do-tests b/testing/do-tests
index 5191d9007a8029949452e95925ade31b4ab61c21..c01152c7bbd21f2012e1b4c74178c2829c22bb75 100755 (executable)
--- a/testing/do-tests
+++ b/testing/do-tests
@@ -726,6 +726,24 @@ do
            }
        }' $TESTDIR/posttest.dat` >> $CONSOLE_LOG 2>&1
 
+       ##########################################################################
+       # check that IPsec state was cleaned up properly
+       #
+
+       for host in $IPSECHOSTS
+       do
+               eval HOSTLOGIN=root@\$ipv4_${host}
+               IPSECSTATE=`ssh $SSHCONF $HOSTLOGIN 'ip xfrm state'`
+               IPSECPOLICY=`ssh $SSHCONF $HOSTLOGIN 'ip xfrm policy'`
+               if [ -n "$IPSECSTATE" -o -n "$IPSECPOLICY" ]
+               then
+                       echo -e "\n$host# ip xfrm state [NO]" >> $CONSOLE_LOG
+                       echo "$IPSECSTATE" >> $CONSOLE_LOG
+                       echo -e "\n$host# ip xfrm policy [NO]" >> $CONSOLE_LOG
+                       echo "$IPSECPOLICY" >> $CONSOLE_LOG
+                       STATUS="failed"
+               fi
+       done
 
        ##########################################################################
        # get a copy of /var/log/auth.log