Merge pull request #2793 from weaveworks/improve-fastdp-crypto-tests

Improve encryption tests

test/110_encryption_2_test.sh

@@ -1,20 +0,0 @@
-#!/bin/bash
-
-. "$(dirname "$0")/config.sh"
-
-C1=10.2.1.4
-C2=10.2.1.7
-
-start_suite "Ping over encrypted cross-host weave network"
-
-weave_on $HOST1 launch --password wfvAwt7sj
-weave_on $HOST2 launch --password wfvAwt7sj $HOST1
-
-start_container $HOST1 $C1/24 --name=c1
-start_container $HOST2 $C2/24 --name=c2
-assert_raises "exec_on $HOST1 c1 $PING $C2"
-
-assert_raises "weave_on $HOST1 status connections | grep encrypted"
-assert_raises "weave_on $HOST2 status connections | grep encrypted"
-
-end_suite

test/110_sleeve_encryption_2_test.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-. ./config.sh
+. "$(dirname "$0")/config.sh"
 
 C1=10.2.1.4
 C2=10.2.1.7

test/111_fastdp_encryption_2_test.sh

@@ -1,30 +1,30 @@
 #!/bin/bash
 
-# TODO(mp) 1. test anti-replay 2. test sleeve <-> fastdp
-# TODO(mp) test with --trusted-subnets
-
 . "$(dirname "$0")/config.sh"
 
 HOST1_IP=$($SSH $HOST1 getent ahosts $HOST1 | grep "RAW" | cut -d' ' -f1)
 HOST2_IP=$($SSH $HOST2 getent ahosts $HOST2 | grep "RAW" | cut -d' ' -f1)
 
+# Assume symmetry
+IFACE=$($SSH $HOST1 ip -o route get $HOST2_IP | grep -o 'dev [^ ]*' | cut -d' ' -f2)
+
 start_tcpdump() {
     HOST=$1
     PCAP=$2
-    run_on $HOST "sudo nohup tcpdump -i any -w $PCAP >/dev/null 2>&1 & echo \$! > $PCAP.pid"
+    run_on $HOST "sudo nohup tcpdump -i $IFACE -U -w $PCAP >/dev/null 2>&1 & echo \$! > $PCAP.pid"
 }
 
 stop_tcpdump() {
     HOST=$1
     PCAP=$2
-    $SSH $HOST "sudo kill \$(cat $PCAP.pid) && rm -f $PCAP.pid && sudo base64 $PCAP" \
+    $SSH $HOST "sudo kill -sSIGINT \$(cat $PCAP.pid) && rm -f $PCAP.pid && sudo base64 $PCAP" \
         | base64 -d > $PCAP
 }
 
-# Checks whether all vxlan-tunneled traffic is encrypted.
+# Checks whether all VXLAN-tunneled traffic is encrypted.
 assert_pcap() {
     PCAP=$1
-    # UDP port is not exposed in ESP
+    # VXLAN (UDP dst port 6784) packets should be encrypted
     assert "tcpdump -r $PCAP 'src $HOST1_IP && dst $HOST2_IP && dst port 6784'" ""
     assert "tcpdump -r $PCAP 'src $HOST2_IP && dst $HOST1_IP && dst port 6784'" ""
     # ip_proto(ESP) = 50
@@ -55,6 +55,9 @@ start_container $HOST1 $C1/24 --name=c1
 start_container $HOST2 $C2/24 --name=c2
 assert_raises "exec_on $HOST1 c1 $PING $C2"
 
+# Let tcpdump to flush captures...
+sleep 1
+
 stop_tcpdump $HOST1 $PCAP1
 stop_tcpdump $HOST2 $PCAP2
 
@@ -66,6 +69,7 @@ weave_on $HOST2 reset
 # the connection.
 assert "$SSH $HOST1 sudo ip xfrm state" ""
 assert "$SSH $HOST1 sudo ip xfrm policy" ""
-assert "$SSH $HOST1 sudo iptables -t mangle -S WEAVE-IPSEC | grep '\-A'" ""
+assert "$SSH $HOST1 sudo iptables -t mangle -S WEAVE-IPSEC-IN | grep '\-A'" ""
+assert "$SSH $HOST1 sudo iptables -t mangle -S WEAVE-IPSEC-OUT | grep '\-A'" ""
 
 end_suite