# establish the tunnel
ipsec auto --up westnet-eastnet-ikev2
../../guestbin/ping-once.sh --up -I 192.0.1.254 192.0.2.254
ipsec whack --trafficstatus

# Let R_U_THERE packets flow
sleep 15

# Setting up block via iptables
iptables -I INPUT -s 192.1.2.23/32 -d 0/0 -j DROP
iptables -I OUTPUT -d 192.1.2.23/32 -s 0/0 -j DROP

# DPD should have triggered now
../../guestbin/wait-for-pluto.sh '^".*#1: liveness action'

# Tunnel should be down with %trap or %hold preventing packet leaks
# But shuntstatus only shows bare shunts, not connection shunts :(
ipsec whack --trafficstatus
ipsec whack --shuntstatus

# packets should be caught in firewall and no icmp replies should
# happen
../../guestbin/ping-once.sh --down -I 192.0.1.254 192.0.2.254

# Remove the Blockage
iptables -D INPUT -s 192.1.2.23/32 -d 0/0 -j DROP
iptables -D OUTPUT -d 192.1.2.23/32 -s 0/0 -j DROP

# Tunnel should be back up now even without triggering traffic
../../guestbin/wait-for-pluto.sh '^".*#[3-9] established Child SA'
../../guestbin/ping-once.sh --up -I 192.0.1.254 192.0.2.254
