 @@ -1,955 +1,955 @@
-#	$NetBSD: t_ipsec.sh,v 1.4 2018/03/13 03:50:26 knakahara Exp $
+#	$NetBSD: t_ipsec.sh,v 1.5 2018/12/25 03:28:29 knakahara Exp $
+#
 # Copyright (c) 2017 Internet Initiative Japan Inc.
 # All rights reserved.
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
 # are met:
 # 1. Redistributions of source code must retain the above copyright
 #    notice, this list of conditions and the following disclaimer.
 # 2. Redistributions in binary form must reproduce the above copyright
 #    notice, this list of conditions and the following disclaimer in the
 #    documentation and/or other materials provided with the distribution.
+#
 # THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 # ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 # PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 # POSSIBILITY OF SUCH DAMAGE.
+#
 SOCK1=unix://commsock1 # for ROUTER1
 SOCK2=unix://commsock2 # for ROUTER2
 ROUTER1_LANIP=192.168.1.1
 ROUTER1_LANNET=192.168.1.0/24
 ROUTER1_WANIP=10.0.0.1
 ROUTER1_IPSECIP=172.16.1.1
 ROUTER1_WANIP_DUMMY=10.0.0.11
 ROUTER1_IPSECIP_DUMMY=172.16.11.1
 ROUTER1_IPSECIP_RECURSIVE1=172.16.101.1
 ROUTER1_IPSECIP_RECURSIVE2=172.16.201.1
 ROUTER2_LANIP=192.168.2.1
 ROUTER2_LANNET=192.168.2.0/24
 ROUTER2_WANIP=10.0.0.2
 ROUTER2_IPSECIP=172.16.2.1
 ROUTER2_WANIP_DUMMY=10.0.0.12
 ROUTER2_IPSECIP_DUMMY=172.16.12.1
 ROUTER2_IPSECIP_RECURSIVE1=172.16.102.1
 ROUTER2_IPSECIP_RECURSIVE2=172.16.202.1
 ROUTER1_LANIP6=fc00:1::1
 ROUTER1_LANNET6=fc00:1::/64
 ROUTER1_WANIP6=fc00::1
 ROUTER1_IPSECIP6=fc00:3::1
 ROUTER1_WANIP6_DUMMY=fc00::11
 ROUTER1_IPSECIP6_DUMMY=fc00:13::1
 ROUTER1_IPSECIP6_RECURSIVE1=fc00:103::1
 ROUTER1_IPSECIP6_RECURSIVE2=fc00:203::1
 ROUTER2_LANIP6=fc00:2::1
 ROUTER2_LANNET6=fc00:2::/64
 ROUTER2_WANIP6=fc00::2
 ROUTER2_IPSECIP6=fc00:4::1
 ROUTER2_WANIP6_DUMMY=fc00::12
 ROUTER2_IPSECIP6_DUMMY=fc00:14::1
 ROUTER2_IPSECIP6_RECURSIVE1=fc00:104::1
 ROUTER2_IPSECIP6_RECURSIVE2=fc00:204::1
 DEBUG=${DEBUG:-false}
 TIMEOUT=7
 atf_test_case ipsecif_create_destroy cleanup
 ipsecif_create_destroy_head()
+{
 	atf_set "descr" "Test creating/destroying gif interfaces"
 	atf_set "require.progs" "rump_server"
+}
 ipsecif_create_destroy_body()
+{
 	rump_server_start $SOCK1 ipsec
 	test_create_destroy_common $SOCK1 ipsec0
+}
 ipsecif_create_destroy_cleanup()
+{
 	$DEBUG && dump
 	cleanup
+}
 setup_router()
+{
 	local sock=${1}
 	local lan=${2}
 	local lan_mode=${3}
 	local wan=${4}
 	local wan_mode=${5}
 	rump_server_add_iface $sock shmif0 bus0
 	rump_server_add_iface $sock shmif1 bus1
 	export RUMP_SERVER=${sock}
 	if [ ${lan_mode} = "ipv6" ]; then
 		atf_check -s exit:0 rump.ifconfig shmif0 inet6 ${lan}
 	else
 		atf_check -s exit:0 rump.ifconfig shmif0 inet ${lan} netmask 0xffffff00
 	fi
 	atf_check -s exit:0 rump.ifconfig shmif0 up
-	rump.ifconfig shmif0
+	$DEBUG && rump.ifconfig shmif0
 	if [ ${wan_mode} = "ipv6" ]; then
 		atf_check -s exit:0 rump.ifconfig shmif1 inet6 ${wan}
 	else
 		atf_check -s exit:0 rump.ifconfig shmif1 inet ${wan} netmask 0xff000000
 	fi
 	atf_check -s exit:0 rump.ifconfig shmif1 up
-	rump.ifconfig shmif1
+	$DEBUG && rump.ifconfig shmif1
 	unset RUMP_SERVER
+}
 test_router()
+{
 	local sock=${1}
 	local lan=${2}
 	local lan_mode=${3}
 	local wan=${4}
 	local wan_mode=${5}
 	export RUMP_SERVER=${sock}
 	atf_check -s exit:0 -o match:shmif0 rump.ifconfig
 	if [ ${lan_mode} = "ipv6" ]; then
 		atf_check -s exit:0 -o ignore rump.ping6 -n -c 1 -X $TIMEOUT ${lan}
 	else
 		atf_check -s exit:0 -o ignore rump.ping -n -c 1 -w $TIMEOUT ${lan}
 	fi
 	atf_check -s exit:0 -o match:shmif1 rump.ifconfig
 	if [ ${wan_mode} = "ipv6" ]; then
 		atf_check -s exit:0 -o ignore rump.ping6 -n -c 1 -X $TIMEOUT ${wan}
 	else
 		atf_check -s exit:0 -o ignore rump.ping -n -c 1 -w $TIMEOUT ${wan}
 	fi
 	unset RUMP_SERVER
+}
 setup()
+{
 	local inner=${1}
 	local outer=${2}
 	rump_server_crypto_start $SOCK1 netipsec netinet6 ipsec
 	rump_server_crypto_start $SOCK2 netipsec netinet6 ipsec
 	router1_lan=""
 	router1_lan_mode=""
 	router2_lan=""
 	router2_lan_mode=""
 	if [ ${inner} = "ipv6" ]; then
 		router1_lan=$ROUTER1_LANIP6
 		router1_lan_mode="ipv6"
 		router2_lan=$ROUTER2_LANIP6
 		router2_lan_mode="ipv6"
 	else
 		router1_lan=$ROUTER1_LANIP
 		router1_lan_mode="ipv4"
 		router2_lan=$ROUTER2_LANIP
 		router2_lan_mode="ipv4"
 	fi
 	if [ ${outer} = "ipv6" ]; then
 		setup_router $SOCK1 ${router1_lan} ${router1_lan_mode} \
 			$ROUTER1_WANIP6 ipv6
 		setup_router $SOCK2 ${router2_lan} ${router2_lan_mode} \
 			$ROUTER2_WANIP6 ipv6
 	else
 		setup_router $SOCK1 ${router1_lan} ${router1_lan_mode} \
 			$ROUTER1_WANIP ipv4
 		setup_router $SOCK2 ${router2_lan} ${router2_lan_mode} \
 			$ROUTER2_WANIP ipv4
 	fi
+}
 test_setup()
+{
 	local inner=${1}
 	local outer=${2}
 	local router1_lan=""
 	local router1_lan_mode=""
 	local router2_lan=""
 	local router2_lan_mode=""
 	if [ ${inner} = "ipv6" ]; then
 		router1_lan=$ROUTER1_LANIP6
 		router1_lan_mode="ipv6"
 		router2_lan=$ROUTER2_LANIP6
 		router2_lan_mode="ipv6"
 	else
 		router1_lan=$ROUTER1_LANIP
 		router1_lan_mode="ipv4"
 		router2_lan=$ROUTER2_LANIP
 		router2_lan_mode="ipv4"
 	fi
 	if [ ${outer} = "ipv6" ]; then
 		test_router $SOCK1 ${router1_lan} ${router1_lan_mode} \
 			$ROUTER1_WANIP6 ipv6
 		test_router $SOCK2 ${router2_lan} ${router2_lan_mode} \
 			$ROUTER2_WANIP6 ipv6
 	else
 		test_router $SOCK1 ${router1_lan} ${router1_lan_mode} \
 			$ROUTER1_WANIP ipv4
 		test_router $SOCK2 ${router2_lan} ${router2_lan_mode} \
 			$ROUTER2_WANIP ipv4
 	fi
+}
 get_if_ipsec_unique()
+{
 	local sock=${1}
 	local src=${2}
 	local proto=${3}
 	local unique=""
 	export RUMP_SERVER=${sock}
 	unique=`$HIJACKING setkey -DP | grep -A2 "^${src}.*(${proto})$" | grep unique | sed 's/.*unique#//'`
 	unset RUMP_SERVER
 	echo $unique
+}
 setup_if_ipsec()
+{
 	local sock=${1}
 	local addr=${2}
 	local remote=${3}
 	local inner=${4}
 	local src=${5}
 	local dst=${6}
 	local peernet=${7}
 	export RUMP_SERVER=${sock}
 	atf_check -s exit:0 rump.ifconfig ipsec0 create
 	atf_check -s exit:0 rump.ifconfig ipsec0 tunnel ${src} ${dst}
 	if [ ${inner} = "ipv6" ]; then
 		atf_check -s exit:0 rump.ifconfig ipsec0 inet6 ${addr}/128 ${remote}
 		atf_check -s exit:0 -o ignore rump.route add -inet6 ${peernet} ${addr}
 	else
 		atf_check -s exit:0 rump.ifconfig ipsec0 inet ${addr}/32 ${remote}
 		atf_check -s exit:0 -o ignore rump.route add -inet ${peernet} ${addr}
 	fi
-	rump.ifconfig ipsec0
+	$DEBUG && rump.ifconfig ipsec0
-	rump.route -nL show
+	$DEBUG && rump.route -nL show
+}
 setup_if_ipsec_sa()
+{
 	local sock=${1}
 	local src=${2}
 	local dst=${3}
 	local mode=${4}
 	local proto=${5}
 	local algo=${6}
 	local dir=${7}
 	local tmpfile=./tmp
 	local inunique=""
 	local outunique=""
 	local inid=""
 	local outid=""
 	local algo_args="$(generate_algo_args $proto $algo)"
 	inunique=`get_if_ipsec_unique ${sock} ${dst} ${mode}`
 	atf_check -s exit:0 test "X$inunique" != "X"
 	outunique=`get_if_ipsec_unique ${sock} ${src} ${mode}`
 	atf_check -s exit:0 test "X$outunique" != "X"
 	if [ ${dir} = "1to2" ] ; then
 	    if [ ${mode} = "ipv6" ] ; then
 		inid="10010"
 		outid="10011"
 	    else
 		inid="10000"
 		outid="10001"
 	    fi
 	else
 	    if [ ${mode} = "ipv6" ] ; then
 		inid="10011"
 		outid="10010"
 	    else
 		inid="10001"
 		outid="10000"
 	    fi
 	fi
 	cat > $tmpfile <<-EOF
     	add $dst $src $proto $inid -u $inunique $algo_args;
     	add $src $dst $proto $outid -u $outunique $algo_args;
 	EOF
 	$DEBUG && cat $tmpfile
 	export RUMP_SERVER=$sock
 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
 	$DEBUG && $HIJACKING setkey -D
 	$DEBUG && $HIJACKING setkey -DP
 	unset RUMP_SERVER
+}
 setup_tunnel()
+{
 	local inner=${1}
 	local outer=${2}
 	local proto=${3}
 	local algo=${4}
 	local addr=""
 	local remote=""
 	local src=""
 	local dst=""
 	local peernet=""
 	if [ ${inner} = "ipv6" ]; then
 		addr=$ROUTER1_IPSECIP6
 		remote=$ROUTER2_IPSECIP6
 		peernet=$ROUTER2_LANNET6
 	else
 		addr=$ROUTER1_IPSECIP
 		remote=$ROUTER2_IPSECIP
 		peernet=$ROUTER2_LANNET
 	fi
 	if [ ${outer} = "ipv6" ]; then
 		src=$ROUTER1_WANIP6
 		dst=$ROUTER2_WANIP6
 	else
 		src=$ROUTER1_WANIP
 		dst=$ROUTER2_WANIP
 	fi
 	setup_if_ipsec $SOCK1 ${addr} ${remote} ${inner} \
 		     ${src} ${dst} ${peernet}
 	if [ $inner = "ipv6" -a $outer = "ipv4" ]; then
 	    setup_if_ipsec_sa $SOCK1 ${src} ${dst} ${outer} ${proto} ${algo} "1to2"
 	fi
 	setup_if_ipsec_sa $SOCK1 ${src} ${dst} ${inner} ${proto} ${algo} "1to2"
 	if [ $inner = "ipv6" ]; then
 		addr=$ROUTER2_IPSECIP6
 		remote=$ROUTER1_IPSECIP6
 		peernet=$ROUTER1_LANNET6
 	else
 		addr=$ROUTER2_IPSECIP
 		remote=$ROUTER1_IPSECIP
 		peernet=$ROUTER1_LANNET
 	fi
 	if [ $outer = "ipv6" ]; then
 		src=$ROUTER2_WANIP6
 		dst=$ROUTER1_WANIP6
 	else
 		src=$ROUTER2_WANIP
 		dst=$ROUTER1_WANIP
 	fi
 	setup_if_ipsec $SOCK2 ${addr} ${remote} ${inner} \
 		     ${src} ${dst} ${peernet} ${proto} ${algo}
 	if [ $inner = "ipv6" -a $outer = "ipv4" ]; then
 	    setup_if_ipsec_sa $SOCK2 ${src} ${dst} ${outer} ${proto} ${algo} "2to1"
 	fi
 	setup_if_ipsec_sa $SOCK2 ${src} ${dst} ${inner} ${proto} ${algo} "2to1"
+}
 test_setup_tunnel()
+{
 	local mode=${1}
 	local peernet=""
 	local opt=""
 	if [ ${mode} = "ipv6" ]; then
 		peernet=$ROUTER2_LANNET6
 		opt="-inet6"
 	else
 		peernet=$ROUTER2_LANNET
 		opt="-inet"
 	fi
 	export RUMP_SERVER=$SOCK1
 	atf_check -s exit:0 -o match:ipsec0 rump.ifconfig
 	atf_check -s exit:0 -o match:ipsec0 rump.route -nL get ${opt} ${peernet}
 	if [ ${mode} = "ipv6" ]; then
 		peernet=$ROUTER1_LANNET6
 		opt="-inet6"
 	else
 		peernet=$ROUTER1_LANNET
 		opt="-inet"
 	fi
 	export RUMP_SERVER=$SOCK2
 	atf_check -s exit:0 -o match:ipsec0 rump.ifconfig
 	atf_check -s exit:0 -o match:ipsec0 rump.route -nL get ${opt} ${peernet}
+}
 teardown_tunnel()
+{
 	export RUMP_SERVER=$SOCK1
 	atf_check -s exit:0 rump.ifconfig ipsec0 deletetunnel
 	atf_check -s exit:0 rump.ifconfig ipsec0 destroy
 	$HIJACKING setkey -F
 	export RUMP_SERVER=$SOCK2
 	atf_check -s exit:0 rump.ifconfig ipsec0 deletetunnel
 	atf_check -s exit:0 rump.ifconfig ipsec0 destroy
 	$HIJACKING setkey -F
 	unset RUMP_SERVER
+}
 setup_dummy_if_ipsec()
+{
 	local sock=${1}
 	local addr=${2}
 	local remote=${3}
 	local inner=${4}
 	local src=${5}
 	local dst=${6}
 	export RUMP_SERVER=${sock}
 	atf_check -s exit:0 rump.ifconfig ipsec1 create
 	atf_check -s exit:0 rump.ifconfig ipsec1 tunnel ${src} ${dst}
 	if [ ${inner} = "ipv6" ]; then
 		atf_check -s exit:0 rump.ifconfig ipsec1 inet6 ${addr}/128 ${remote}
 	else
 		atf_check -s exit:0 rump.ifconfig ipsec1 inet ${addr}/32 ${remote}
 	fi
-	rump.ifconfig ipsec1
+	$DEBUG && rump.ifconfig ipsec1
 	unset RUMP_SERVER
+}
 setup_dummy_if_ipsec_sa()
+{
 	local sock=${1}
 	local src=${2}
 	local dst=${3}
 	local mode=${4}
 	local proto=${5}
 	local algo=${6}
 	local dir=${7}
 	local tmpfile=./tmp
 	local inunique=""
 	local outunique=""
 	local inid=""
 	local outid=""
 	local algo_args="$(generate_algo_args $proto $algo)"
 	inunique=`get_if_ipsec_unique ${sock} ${dst} ${mode}`
 	atf_check -s exit:0 test "X$inunique" != "X"
 	outunique=`get_if_ipsec_unique ${sock} ${src} ${mode}`
 	atf_check -s exit:0 test "X$outunique" != "X"
 	if [ ${dir} = "1to2" ] ; then
 	    inid="20000"
 	    outid="20001"
 	else
 	    inid="20001"
 	    outid="20000"
 	fi
 	cat > $tmpfile <<-EOF
     	add $dst $src $proto $inid -u $inunique $algo_args;
     	add $src $dst $proto $outid -u $outunique $algo_args;
 	EOF
 	$DEBUG && cat $tmpfile
 	export RUMP_SERVER=$sock
 	atf_check -s exit:0 -o empty $HIJACKING setkey -c < $tmpfile
 	$DEBUG && $HIJACKING setkey -D
 	$DEBUG && $HIJACKING setkey -DP
 	unset RUMP_SERVER
+}
 setup_dummy_tunnel()
+{
 	local inner=${1}
 	local outer=${2}
 	local proto=${3}
 	local algo=${4}
 	local addr=""
 	local remote=""
 	local src=""
 	local dst=""
 	if [ ${inner} = "ipv6" ]; then
 		addr=$ROUTER1_IPSECIP6_DUMMY
 		remote=$ROUTER2_IPSECIP6_DUMMY
 	else
 		addr=$ROUTER1_IPSECIP_DUMMY
 		remote=$ROUTER2_IPSECIP_DUMMY
 	fi
 	if [ ${outer} = "ipv6" ]; then
 		src=$ROUTER1_WANIP6_DUMMY
 		dst=$ROUTER2_WANIP6_DUMMY
 	else
 		src=$ROUTER1_WANIP_DUMMY
 		dst=$ROUTER2_WANIP_DUMMY
 	fi
 	setup_dummy_if_ipsec $SOCK1 ${addr} ${remote} ${inner} \
 			   ${src} ${dst} ${proto} ${algo} "1to2"
 	setup_dummy_if_ipsec_sa $SOCK1 ${src} ${dst} ${inner} ${proto} ${algo} "1to2"
 	if [ $inner = "ipv6" ]; then
 		addr=$ROUTER2_IPSECIP6_DUMMY
 		remote=$ROUTER1_IPSECIP6_DUMMY
 	else
 		addr=$ROUTER2_IPSECIP_DUMMY
 		remote=$ROUTER1_IPSECIP_DUMMY
 	fi
 	if [ $outer = "ipv6" ]; then
 		src=$ROUTER2_WANIP6_DUMMY
 		dst=$ROUTER1_WANIP6_DUMMY
 	else
 		src=$ROUTER2_WANIP_DUMMY
 		dst=$ROUTER1_WANIP_DUMMY
 	fi
 	setup_dummy_if_ipsec $SOCK2 ${addr} ${remote} ${inner} \
 			   ${src} ${dst} ${proto} ${algo} "2to1"
 	setup_dummy_if_ipsec_sa $SOCK2 ${src} ${dst} ${inner} ${proto} ${algo} "2to1"
+}
 test_setup_dummy_tunnel()
+{
 	export RUMP_SERVER=$SOCK1
 	atf_check -s exit:0 -o match:ipsec1 rump.ifconfig
 	export RUMP_SERVER=$SOCK2
 	atf_check -s exit:0 -o match:ipsec1 rump.ifconfig
 	unset RUMP_SERVER
+}
 teardown_dummy_tunnel()
+{
 	export RUMP_SERVER=$SOCK1
 	atf_check -s exit:0 rump.ifconfig ipsec1 deletetunnel
 	atf_check -s exit:0 rump.ifconfig ipsec1 destroy
 	export RUMP_SERVER=$SOCK2
 	atf_check -s exit:0 rump.ifconfig ipsec1 deletetunnel
 	atf_check -s exit:0 rump.ifconfig ipsec1 destroy
 	unset RUMP_SERVER
+}
 setup_recursive_if_ipsec()
+{
 	local sock=${1}
 	local ipsec=${2}
 	local addr=${3}
 	local remote=${4}
 	local inner=${5}
 	local src=${6}
 	local dst=${7}
 	local proto=${8}
 	local algo=${9}
 	local dir=${10}
 	export RUMP_SERVER=${sock}
 	atf_check -s exit:0 rump.ifconfig ${ipsec} create
 	atf_check -s exit:0 rump.ifconfig ${ipsec} tunnel ${src} ${dst}
 	if [ ${inner} = "ipv6" ]; then
 		atf_check -s exit:0 rump.ifconfig ${ipsec} inet6 ${addr}/128 ${remote}
 	else
 		atf_check -s exit:0 rump.ifconfig ${ipsec} inet ${addr}/32 ${remote}
 	fi
 	setup_if_ipsec_sa $sock ${src} ${dst} ${inner} ${proto} ${algo} ${dir}
 	export RUMP_SERVER=${sock}
-	rump.ifconfig ${ipsec}
+	$DEBUG && rump.ifconfig ${ipsec}
 	unset RUMP_SERVER
+}
 # test in ROUTER1 only
 setup_recursive_tunnels()
+{
 	local mode=${1}
 	local proto=${2}
 	local algo=${3}
 	local addr=""
 	local remote=""
 	local src=""
 	local dst=""
 	if [ ${mode} = "ipv6" ]; then
 		addr=$ROUTER1_IPSECIP6_RECURSIVE1
 		remote=$ROUTER2_IPSECIP6_RECURSIVE1
 		src=$ROUTER1_IPSECIP6
 		dst=$ROUTER2_IPSECIP6
 	else
 		addr=$ROUTER1_IPSECIP_RECURSIVE1
 		remote=$ROUTER2_IPSECIP_RECURSIVE1
 		src=$ROUTER1_IPSECIP
 		dst=$ROUTER2_IPSECIP
 	fi
 	setup_recursive_if_ipsec $SOCK1 ipsec1 ${addr} ${remote} ${mode} \
 		      ${src} ${dst} ${proto} ${algo} "1to2"
 	if [ ${mode} = "ipv6" ]; then
 		addr=$ROUTER1_IPSECIP6_RECURSIVE2
 		remote=$ROUTER2_IPSECIP6_RECURSIVE2
 		src=$ROUTER1_IPSECIP6_RECURSIVE1
 		dst=$ROUTER2_IPSECIP6_RECURSIVE1
 	else
 		addr=$ROUTER1_IPSECIP_RECURSIVE2
 		remote=$ROUTER2_IPSECIP_RECURSIVE2
 		src=$ROUTER1_IPSECIP_RECURSIVE1
 		dst=$ROUTER2_IPSECIP_RECURSIVE1
 	fi
 	setup_recursive_if_ipsec $SOCK1 ipsec2 ${addr} ${remote} ${mode} \
 		      ${src} ${dst} ${proto} ${algo} "1to2"
+}
 # test in router1 only
 test_recursive_check()
+{
 	local mode=$1
 	export RUMP_SERVER=$SOCK1
 	if [ ${mode} = "ipv6" ]; then
 		atf_check -s not-exit:0 -o ignore -e ignore \
 			rump.ping6 -n -X $TIMEOUT -c 1 $ROUTER2_IPSECIP6_RECURSIVE2
 	else
 		atf_check -s not-exit:0 -o ignore -e ignore \
 			rump.ping -n -w $TIMEOUT -c 1 $ROUTER2_IPSECIP_RECURSIVE2
 	fi
 	atf_check -o match:'ipsec0: recursively called too many times' \
 		-x "$HIJACKING dmesg"
 	$HIJACKING dmesg
 	unset RUMP_SERVER
+}
 teardown_recursive_tunnels()
+{
 	export RUMP_SERVER=$SOCK1
 	atf_check -s exit:0 rump.ifconfig ipsec1 deletetunnel
 	atf_check -s exit:0 rump.ifconfig ipsec1 destroy
 	atf_check -s exit:0 rump.ifconfig ipsec2 deletetunnel
 	atf_check -s exit:0 rump.ifconfig ipsec2 destroy
 	unset RUMP_SERVER
+}
 test_ping_failure()
+{
 	local mode=$1
 	export RUMP_SERVER=$SOCK1
 	if [ ${mode} = "ipv6" ]; then
 		atf_check -s not-exit:0 -o ignore -e ignore \
 			rump.ping6 -n -X $TIMEOUT -c 1 -S $ROUTER1_LANIP6 \
 			$ROUTER2_LANIP6
 	else
 		atf_check -s not-exit:0 -o ignore -e ignore \
 			rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER1_LANIP \
 			$ROUTER2_LANIP
 	fi
 	export RUMP_SERVER=$SOCK2
 	if [ ${mode} = "ipv6" ]; then
 		atf_check -s not-exit:0 -o ignore -e ignore \
 			rump.ping6 -n -X $TIMEOUT -c 1 -S $ROUTER2_LANIP6 \
 			$ROUTER1_LANIP6
 	else
 		atf_check -s not-exit:0 -o ignore -e ignore \
 			rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER1_LANIP \
 			$ROUTER2_LANIP
 	fi
 	unset RUMP_SERVER
+}
 test_ping_success()
+{
 	mode=$1
 	export RUMP_SERVER=$SOCK1
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
 	if [ ${mode} = "ipv6" ]; then
 		# XXX
 		# rump.ping6 rarely fails with the message that
 		# "failed to get receiving hop limit".
 		# This is a known issue being analyzed.
 		atf_check -s exit:0 -o ignore \
 			rump.ping6 -n -X $TIMEOUT -c 1 -S $ROUTER1_LANIP6 \
 			$ROUTER2_LANIP6
 	else
 		atf_check -s exit:0 -o ignore \
 			rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER1_LANIP \
 			$ROUTER2_LANIP
 	fi
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
 	export RUMP_SERVER=$SOCK2
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
 	if [ ${mode} = "ipv6" ]; then
 		atf_check -s exit:0 -o ignore \
 			rump.ping6 -n -X $TIMEOUT -c 1 -S $ROUTER2_LANIP6 \
 			$ROUTER1_LANIP6
 	else
 		atf_check -s exit:0 -o ignore \
 			rump.ping -n -w $TIMEOUT -c 1 -I $ROUTER2_LANIP \
 			$ROUTER1_LANIP
 	fi
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
 	unset RUMP_SERVER
+}
 test_change_tunnel_duplicate()
+{
 	local mode=$1
 	local newsrc=""
 	local newdst=""
 	if [ ${mode} = "ipv6" ]; then
 		newsrc=$ROUTER1_WANIP6_DUMMY
 		newdst=$ROUTER2_WANIP6_DUMMY
 	else
 		newsrc=$ROUTER1_WANIP_DUMMY
 		newdst=$ROUTER2_WANIP_DUMMY
 	fi
 	export RUMP_SERVER=$SOCK1
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
-	rump.ifconfig -v ipsec1
+	$DEBUG && rump.ifconfig -v ipsec1
 	atf_check -s exit:0 -e match:SIOCSLIFPHYADDR \
 		rump.ifconfig ipsec0 tunnel ${newsrc} ${newdst}
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
-	rump.ifconfig -v ipsec1
+	$DEBUG && rump.ifconfig -v ipsec1
 	if [ ${mode} = "ipv6" ]; then
 		newsrc=$ROUTER2_WANIP6_DUMMY
 		newdst=$ROUTER1_WANIP6_DUMMY
 	else
 		newsrc=$ROUTER2_WANIP_DUMMY
 		newdst=$ROUTER1_WANIP_DUMMY
 	fi
 	export RUMP_SERVER=$SOCK2
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
-	rump.ifconfig -v ipsec1
+	$DEBUG && rump.ifconfig -v ipsec1
 	atf_check -s exit:0 -e match:SIOCSLIFPHYADDR \
 		rump.ifconfig ipsec0 tunnel ${newsrc} ${newdst}
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
-	rump.ifconfig -v ipsec1
+	$DEBUG && rump.ifconfig -v ipsec1
 	unset RUMP_SERVER
+}
 test_change_tunnel_success()
+{
 	local mode=$1
 	local newsrc=""
 	local newdst=""
 	if [ ${mode} = "ipv6" ]; then
 		newsrc=$ROUTER1_WANIP6_DUMMY
 		newdst=$ROUTER2_WANIP6_DUMMY
 	else
 		newsrc=$ROUTER1_WANIP_DUMMY
 		newdst=$ROUTER2_WANIP_DUMMY
 	fi
 	export RUMP_SERVER=$SOCK1
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
 	atf_check -s exit:0 \
 		rump.ifconfig ipsec0 tunnel ${newsrc} ${newdst}
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
 	if [ ${mode} = "ipv6" ]; then
 		newsrc=$ROUTER2_WANIP6_DUMMY
 		newdst=$ROUTER1_WANIP6_DUMMY
 	else
 		newsrc=$ROUTER2_WANIP_DUMMY
 		newdst=$ROUTER1_WANIP_DUMMY
 	fi
 	export RUMP_SERVER=$SOCK2
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
 	atf_check -s exit:0 \
 		rump.ifconfig ipsec0 tunnel ${newsrc} ${newdst}
-	rump.ifconfig -v ipsec0
+	$DEBUG && rump.ifconfig -v ipsec0
 	unset RUMP_SERVER
+}
 basic_setup()
+{
 	local inner=$1
 	local outer=$2
 	local proto=$3
 	local algo=$4
 	setup ${inner} ${outer}
 	test_setup ${inner} ${outer}
 	# Enable once PR kern/49219 is fixed
 	#test_ping_failure
 	setup_tunnel ${inner} ${outer} ${proto} ${algo}
 	sleep 1
 	test_setup_tunnel ${inner}
+}
 basic_test()
+{
 	local inner=$1
 	local outer=$2 # not use
 	test_ping_success ${inner}
+}
 basic_teardown()
+{
 	local inner=$1
 	local outer=$2 # not use
 	teardown_tunnel
 	test_ping_failure ${inner}
+}
 ioctl_setup()
+{
 	local inner=$1
 	local outer=$2
 	local proto=$3
 	local algo=$4
 	setup ${inner} ${outer}
 	test_setup ${inner} ${outer}
 	# Enable once PR kern/49219 is fixed
 	#test_ping_failure
 	setup_tunnel ${inner} ${outer} ${proto} ${algo}
 	setup_dummy_tunnel ${inner} ${outer} ${proto} ${algo}
 	sleep 1
 	test_setup_tunnel ${inner}
+}
 ioctl_test()
+{
 	local inner=$1
 	local outer=$2
 	test_ping_success ${inner}
 	test_change_tunnel_duplicate ${outer}
 	teardown_dummy_tunnel
 	test_change_tunnel_success ${outer}
+}
 ioctl_teardown()
+{
 	local inner=$1
 	local outer=$2 # not use
 	teardown_tunnel
 	test_ping_failure ${inner}
+}
 recursive_setup()
+{
 	local inner=$1
 	local outer=$2
 	local proto=$3
 	local algo=$4
 	setup ${inner} ${outer}
 	test_setup ${inner} ${outer}
 	# Enable once PR kern/49219 is fixed
 	#test_ping_failure
 	setup_tunnel ${inner} ${outer} ${proto} ${algo}
 	setup_recursive_tunnels ${inner} ${proto} ${algo}
 	sleep 1
 	test_setup_tunnel ${inner}
+}
 recursive_test()
+{
 	local inner=$1
 	local outer=$2 # not use
 	test_recursive_check ${inner}
+}
 recursive_teardown()
+{
 	local inner=$1 # not use
 	local outer=$2 # not use
 	teardown_recursive_tunnels
 	teardown_tunnel
+}
 add_test()
+{
 	local category=$1
 	local desc=$2
 	local inner=$3
 	local outer=$4
 	local proto=$5
 	local algo=$6
 	local _algo=$(echo $algo | sed 's/-//g')
 	name="ipsecif_${category}_${inner}over${outer}_${proto}_${_algo}"
 	fulldesc="Does ${inner} over ${outer} if_ipsec ${desc}"
 	atf_test_case ${name} cleanup
 	eval "${name}_head() {
 			atf_set descr \"${fulldesc}\"
 			atf_set require.progs rump_server setkey
+		}
 	    ${name}_body() {
 			${category}_setup ${inner} ${outer} ${proto} ${algo}
 			${category}_test ${inner} ${outer}
 			${category}_teardown ${inner} ${outer}
 			rump_server_destroy_ifaces
+	    }
 	    ${name}_cleanup() {
 			\$DEBUG && dump
 			cleanup
 		}"
 	atf_add_test_case ${name}
+}
 add_test_allproto()
+{
 	local category=$1
 	local desc=$2
 	for algo in $ESP_ENCRYPTION_ALGORITHMS_MINIMUM; do
 		add_test ${category} "${desc}" ipv4 ipv4 esp $algo
 		add_test ${category} "${desc}" ipv4 ipv6 esp $algo
 		add_test ${category} "${desc}" ipv6 ipv4 esp $algo
 		add_test ${category} "${desc}" ipv6 ipv6 esp $algo
 	done
 	# ah does not support yet
+}
 atf_init_test_cases()
+{
 	atf_add_test_case ipsecif_create_destroy
 	add_test_allproto basic "basic tests"
 	add_test_allproto ioctl "ioctl tests"
 	add_test_allproto recursive "recursive check tests"
+}