From 8211afe5d54e10ac9aad0ab00277afac3c7b6c00 Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Fri, 10 Feb 2017 17:20:24 +0000
Subject: [PATCH 1/2] Improve 111_fastdp_encryption_2_test.sh

---
 test/111_fastdp_encryption_2_test.sh | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/test/111_fastdp_encryption_2_test.sh b/test/111_fastdp_encryption_2_test.sh
index 19baf308..4202af85 100755
--- a/test/111_fastdp_encryption_2_test.sh
+++ b/test/111_fastdp_encryption_2_test.sh
@@ -1,30 +1,30 @@
 #!/bin/bash
 
-# TODO(mp) 1. test anti-replay 2. test sleeve <-> fastdp
-# TODO(mp) test with --trusted-subnets
-
 . "$(dirname "$0")/config.sh"
 
 HOST1_IP=$($SSH $HOST1 getent ahosts $HOST1 | grep "RAW" | cut -d' ' -f1)
 HOST2_IP=$($SSH $HOST2 getent ahosts $HOST2 | grep "RAW" | cut -d' ' -f1)
 
+# Assume symmetry
+IFACE=$($SSH $HOST1 ip -o route get $HOST2_IP | grep -o 'dev [^ ]*' | cut -d' ' -f2)
+
 start_tcpdump() {
     HOST=$1
     PCAP=$2
-    run_on $HOST "sudo nohup tcpdump -i any -w $PCAP >/dev/null 2>&1 & echo \$! > $PCAP.pid"
+    run_on $HOST "sudo nohup tcpdump -i $IFACE -U -w $PCAP >/dev/null 2>&1 & echo \$! > $PCAP.pid"
 }
 
 stop_tcpdump() {
     HOST=$1
     PCAP=$2
-    $SSH $HOST "sudo kill \$(cat $PCAP.pid) && rm -f $PCAP.pid && sudo base64 $PCAP" \
+    $SSH $HOST "sudo kill -sSIGINT \$(cat $PCAP.pid) && rm -f $PCAP.pid && sudo base64 $PCAP" \
         | base64 -d > $PCAP
 }
 
-# Checks whether all vxlan-tunneled traffic is encrypted.
+# Checks whether all VXLAN-tunneled traffic is encrypted.
 assert_pcap() {
     PCAP=$1
-    # UDP port is not exposed in ESP
+    # VXLAN (UDP dst port 6784) packets should be encrypted
     assert "tcpdump -r $PCAP 'src $HOST1_IP && dst $HOST2_IP && dst port 6784'" ""
     assert "tcpdump -r $PCAP 'src $HOST2_IP && dst $HOST1_IP && dst port 6784'" ""
     # ip_proto(ESP) = 50
@@ -55,6 +55,9 @@ start_container $HOST1 $C1/24 --name=c1
 start_container $HOST2 $C2/24 --name=c2
 assert_raises "exec_on $HOST1 c1 $PING $C2"
 
+# Let tcpdump to flush captures...
+sleep 1
+
 stop_tcpdump $HOST1 $PCAP1
 stop_tcpdump $HOST2 $PCAP2
 
@@ -66,6 +69,7 @@ weave_on $HOST2 reset
 # the connection.
 assert "$SSH $HOST1 sudo ip xfrm state" ""
 assert "$SSH $HOST1 sudo ip xfrm policy" ""
-assert "$SSH $HOST1 sudo iptables -t mangle -S WEAVE-IPSEC | grep '\-A'" ""
+assert "$SSH $HOST1 sudo iptables -t mangle -S WEAVE-IPSEC-IN | grep '\-A'" ""
+assert "$SSH $HOST1 sudo iptables -t mangle -S WEAVE-IPSEC-OUT | grep '\-A'" ""
 
 end_suite

From 7f48cc92391fabc569cf6b5b8afeb48133ad42bb Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Fri, 10 Feb 2017 17:30:30 +0000
Subject: [PATCH 2/2] Replace 110_encryption_2_test.sh by
 110_sleeve_encryption_2_test.sh

---
 test/110_encryption_2_test.sh        | 20 --------------------
 test/110_sleeve_encryption_2_test.sh |  2 +-
 2 files changed, 1 insertion(+), 21 deletions(-)
 delete mode 100755 test/110_encryption_2_test.sh

diff --git a/test/110_encryption_2_test.sh b/test/110_encryption_2_test.sh
deleted file mode 100755
index b6e11ea7..00000000
--- a/test/110_encryption_2_test.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/bash
-
-. "$(dirname "$0")/config.sh"
-
-C1=10.2.1.4
-C2=10.2.1.7
-
-start_suite "Ping over encrypted cross-host weave network"
-
-weave_on $HOST1 launch --password wfvAwt7sj
-weave_on $HOST2 launch --password wfvAwt7sj $HOST1
-
-start_container $HOST1 $C1/24 --name=c1
-start_container $HOST2 $C2/24 --name=c2
-assert_raises "exec_on $HOST1 c1 $PING $C2"
-
-assert_raises "weave_on $HOST1 status connections | grep encrypted"
-assert_raises "weave_on $HOST2 status connections | grep encrypted"
-
-end_suite
diff --git a/test/110_sleeve_encryption_2_test.sh b/test/110_sleeve_encryption_2_test.sh
index 709548d9..13ebc161 100755
--- a/test/110_sleeve_encryption_2_test.sh
+++ b/test/110_sleeve_encryption_2_test.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-. ./config.sh
+. "$(dirname "$0")/config.sh"
 
 C1=10.2.1.4
 C2=10.2.1.7