| Message ID | 20240118-tcp-ao-test-key-mgmt-v1-0-3583ca147113@arista.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | selftests/net: A couple of typos fixes in key-management test | expand |
On Thu, 18 Jan 2024 02:51:33 +0000 Dmitry Safonov wrote: > Two typo fixes, noticed by Mohammad's review. > And a fix for an issue that got uncovered. Somewhat unrelated to these fixes but related to the tcp_ao selftests in general - could you please also add a config file so that it's easy to build a minimal kernel for running the tests? Something like: make defconfig make kvm_guest.config make tools/testing/selftests/net/tcp_ao/config should give us a suitable config. Differently put it'd be great to have a config we can pass to vmtest or virtme-ng and run the tests.
On 1/18/24 16:51, Jakub Kicinski wrote: > On Thu, 18 Jan 2024 02:51:33 +0000 Dmitry Safonov wrote: >> Two typo fixes, noticed by Mohammad's review. >> And a fix for an issue that got uncovered. > > Somewhat unrelated to these fixes but related to the tcp_ao selftests > in general - could you please also add a config file so that it's > easy to build a minimal kernel for running the tests? > > Something like: > > make defconfig > make kvm_guest.config > make tools/testing/selftests/net/tcp_ao/config Yep, sounds good to me. I'll take as a base tools/testing/selftests/net/config and add any needed config options on the top. > should give us a suitable config. Differently put it'd be great to have > a config we can pass to vmtest or virtme-ng and run the tests. Will check that it works with them. Thanks, Dmitry
On Thu, 18 Jan 2024 17:04:25 +0000 Dmitry Safonov wrote: > > Somewhat unrelated to these fixes but related to the tcp_ao selftests > > in general - could you please also add a config file so that it's > > easy to build a minimal kernel for running the tests? > > > > Something like: > > > > make defconfig > > make kvm_guest.config > > make tools/testing/selftests/net/tcp_ao/config > > Yep, sounds good to me. > I'll take as a base tools/testing/selftests/net/config and add any > needed config options on the top. You probably want something smaller to be honest. tools/testing/selftests/net/config has a lot of stuff in it and it's actually missing a lot more. I'm working thru adding the missing options to tools/testing/selftests/net/config right now so far I got: # tun / tap +CONFIG_TUN=y +CONFIG_MACVLAN=y +CONFIG_MACVTAP=y +CONFIG_NET_SCH_FQ_CODEL=m +# l2tp +CONFIG_L2TP=m +CONFIG_L2TP_V3=y +CONFIG_L2TP_IP=m +CONFIG_L2TP_ETH=m +# sctp-vrf (need SCTP_DIAG to appear) +CONFIG_INET_DIAG=y +# txtimestamp +CONFIG_NET_CLS_U32=m +# test-vxlan-mdb-sh etc. +CONFIG_BRIDGE_VLAN_FILTERING=y +# gre_gso.sh etc. +CONFIG_NET_IPGRE_DEMUX=m +CONFIG_IP_GRE=m +CONFIG_IPV6_GRE=m +# ./srv6_end_dt*_l3vpn_test.sh +CONFIG_IPV6_SEG6_LWTUNNEL=y +# local port something.. +CONFIG_MPTCP=y +# fib_test.sh +CONFIG_NET_CLS_BASIC=m
On 1/18/24 17:13, Jakub Kicinski wrote: > On Thu, 18 Jan 2024 17:04:25 +0000 Dmitry Safonov wrote: >>> Somewhat unrelated to these fixes but related to the tcp_ao selftests >>> in general - could you please also add a config file so that it's >>> easy to build a minimal kernel for running the tests? >>> >>> Something like: >>> >>> make defconfig >>> make kvm_guest.config >>> make tools/testing/selftests/net/tcp_ao/config >> >> Yep, sounds good to me. >> I'll take as a base tools/testing/selftests/net/config and add any >> needed config options on the top. > > You probably want something smaller to be honest. > tools/testing/selftests/net/config has a lot of stuff in it > and it's actually missing a lot more. I'm working thru adding > the missing options to tools/testing/selftests/net/config > right now so far I got: Thanks! I'll send a patch for it in version 2 (as I anyway need to address Simon's feedback). > > # tun / tap > +CONFIG_TUN=y > +CONFIG_MACVLAN=y > +CONFIG_MACVTAP=y > +CONFIG_NET_SCH_FQ_CODEL=m > +# l2tp > +CONFIG_L2TP=m > +CONFIG_L2TP_V3=y > +CONFIG_L2TP_IP=m > +CONFIG_L2TP_ETH=m > +# sctp-vrf (need SCTP_DIAG to appear) > +CONFIG_INET_DIAG=y > +# txtimestamp > +CONFIG_NET_CLS_U32=m > +# test-vxlan-mdb-sh etc. > +CONFIG_BRIDGE_VLAN_FILTERING=y > +# gre_gso.sh etc. > +CONFIG_NET_IPGRE_DEMUX=m > +CONFIG_IP_GRE=m > +CONFIG_IPV6_GRE=m > +# ./srv6_end_dt*_l3vpn_test.sh > +CONFIG_IPV6_SEG6_LWTUNNEL=y > +# local port something.. > +CONFIG_MPTCP=y > +# fib_test.sh > +CONFIG_NET_CLS_BASIC=m Thanks, Dmitry
On Fri, 19 Jan 2024 18:39:14 +0000 Dmitry Safonov wrote: > > You probably want something smaller to be honest. > > tools/testing/selftests/net/config has a lot of stuff in it > > and it's actually missing a lot more. I'm working thru adding > > the missing options to tools/testing/selftests/net/config > > right now so far I got: > > Thanks! > > I'll send a patch for it in version 2 (as I anyway need to address > Simon's feedback). Hi Dmitry! I put TCP_AO and VETH in the config and the tests seem to fail with selftests: net/tcp_ao: rst_ipv4 not ok 1 # error 834[lib/kconfig.c:143] Failed to initialize kconfig 2: No such file or directory # Planned tests != run tests (0 != 1) # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:1 The script does: target=net/tcp_ao make mrproper vng -v -b -f tools/testing/selftests/$target # build the scripts make headers make -C tools/testing/selftests/$target vng -v -r arch/x86/boot/bzImage --user root # inside the VM make -C tools/testing/selftests TARGETS=$target run_tests
Hi Jakub, On 1/24/24 15:12, Jakub Kicinski wrote: > On Fri, 19 Jan 2024 18:39:14 +0000 Dmitry Safonov wrote: >>> You probably want something smaller to be honest. >>> tools/testing/selftests/net/config has a lot of stuff in it >>> and it's actually missing a lot more. I'm working thru adding >>> the missing options to tools/testing/selftests/net/config >>> right now so far I got: >> >> Thanks! >> >> I'll send a patch for it in version 2 (as I anyway need to address >> Simon's feedback). > > Hi Dmitry! > > I put TCP_AO and VETH in the config and the tests seem to fail with Thanks for wiring it up and for https://netdev.bots.linux.dev/status.html! > selftests: net/tcp_ao: rst_ipv4 > not ok 1 # error 834[lib/kconfig.c:143] Failed to initialize kconfig 2: No such file or directory > # Planned tests != run tests (0 != 1) > # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:1 Hehe, yeah I wanted to detect kernels with !CONFIG_TCP_AO, to SKIP the test, rather than FAIL it, which this lib/kconfig.c does. But from a glance, I think it's failing in your run because there are checks with and without TCP_AO, but I didn't think of checking for the hashing algorithms support. I think what happens is has_tcp_ao(): : strcpy(tmp.alg_name, "hmac(sha1)"); ... : if (setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tmp, sizeof(tmp)) < 0) Could you check that what I suppose is failing, is actually failing? [dima@Mindolluin linux-master]$ grep -e '\<CONFIG_CRYPTO_SHA1\>' -e '\<CONFIG_CRYPTO_HMAC\>' .config CONFIG_CRYPTO_HMAC=y CONFIG_CRYPTO_SHA1=y If that's the case, I'll add the detection for hashing algorithms to lib/kconfig.c (together with a patch for tools/testing/selftests/net/config). And also heads up for key-management.c - that tries a bunch of hashing algorithms to check that the work and that the key rotation between different algorithms works: : const char *test_algos[] = { : "cmac(aes128)", : "hmac(sha1)", "hmac(sha512)", "hmac(sha384)", "hmac(sha256)", : "hmac(sha224)", "hmac(sha3-512)", : /* only if !CONFIG_FIPS */ : #define TEST_NON_FIPS_ALGOS 2 : "hmac(rmd160)", "hmac(md5)" : }; > The script does: > > target=net/tcp_ao > make mrproper > > vng -v -b -f tools/testing/selftests/$target > # build the scripts > make headers > make -C tools/testing/selftests/$target > > vng -v -r arch/x86/boot/bzImage --user root > # inside the VM > make -C tools/testing/selftests TARGETS=$target run_tests Thanks, Dmitry
On Wed, 24 Jan 2024 17:46:10 +0000 Dmitry Safonov wrote: > >> Thanks! > >> > >> I'll send a patch for it in version 2 (as I anyway need to address > >> Simon's feedback). > > > > Hi Dmitry! > > > > I put TCP_AO and VETH in the config and the tests seem to fail with > > Thanks for wiring it up and for https://netdev.bots.linux.dev/status.html! > > > selftests: net/tcp_ao: rst_ipv4 > > not ok 1 # error 834[lib/kconfig.c:143] Failed to initialize kconfig 2: No such file or directory > > # Planned tests != run tests (0 != 1) > > # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:1 > > Hehe, yeah I wanted to detect kernels with !CONFIG_TCP_AO, to SKIP the > test, rather than FAIL it, which this lib/kconfig.c does. > But from a glance, I think it's failing in your run because there are > checks with and without TCP_AO, but I didn't think of checking for > the hashing algorithms support. > > I think what happens is has_tcp_ao(): > : strcpy(tmp.alg_name, "hmac(sha1)"); > ... > : if (setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tmp, sizeof(tmp)) < 0) > > Could you check that what I suppose is failing, is actually failing? > [dima@Mindolluin linux-master]$ grep -e '\<CONFIG_CRYPTO_SHA1\>' -e > '\<CONFIG_CRYPTO_HMAC\>' .config > CONFIG_CRYPTO_HMAC=y > CONFIG_CRYPTO_SHA1=y FWIW the config used is uploaded with the results. If you click on the remote it should take you to a location like this: https://netdev-2.bots.linux.dev/vmksft-tcp-ao/results/435369/ and there should be a config file in there. > If that's the case, I'll add the detection for hashing algorithms to > lib/kconfig.c (together with a patch for > tools/testing/selftests/net/config). > And also heads up for key-management.c - that tries a bunch of hashing > algorithms to check that the work and that the key rotation between > different algorithms works: > > : const char *test_algos[] = { > : "cmac(aes128)", > : "hmac(sha1)", "hmac(sha512)", "hmac(sha384)", "hmac(sha256)", > : "hmac(sha224)", "hmac(sha3-512)", > : /* only if !CONFIG_FIPS */ > : #define TEST_NON_FIPS_ALGOS 2 > : "hmac(rmd160)", "hmac(md5)" > : }; I was stuck in a meeting and I started playing around with the options for TCP-AO :) I added these options now: CONFIG_CRYPTO_HMAC=y CONFIG_CRYPTO_SHA1=y CONFIG_CRYPTO_RMD160=y CONFIG_IPV6=y CONFIG_TCP_AO=y CONFIG_TCP_MD5SIG=y CONFIG_VETH=m And it looks much better! There are still some failures: https://netdev.bots.linux.dev/contest.html?branch=net-next-2024-01-24--18-00&executor=vmksft-tcp-ao I added VRF so that should hopefully take care of the MD5 skips on the next run. But the failures of the rst-ip* tests don't look like an obvious config problem.
On 1/24/24 19:04, Jakub Kicinski wrote: > On Wed, 24 Jan 2024 17:46:10 +0000 Dmitry Safonov wrote: >>>> Thanks! >>>> >>>> I'll send a patch for it in version 2 (as I anyway need to address >>>> Simon's feedback). >>> >>> Hi Dmitry! >>> >>> I put TCP_AO and VETH in the config and the tests seem to fail with >> >> Thanks for wiring it up and for https://netdev.bots.linux.dev/status.html! >> >>> selftests: net/tcp_ao: rst_ipv4 >>> not ok 1 # error 834[lib/kconfig.c:143] Failed to initialize kconfig 2: No such file or directory >>> # Planned tests != run tests (0 != 1) >>> # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:1 >> >> Hehe, yeah I wanted to detect kernels with !CONFIG_TCP_AO, to SKIP the >> test, rather than FAIL it, which this lib/kconfig.c does. >> But from a glance, I think it's failing in your run because there are >> checks with and without TCP_AO, but I didn't think of checking for >> the hashing algorithms support. >> >> I think what happens is has_tcp_ao(): >> : strcpy(tmp.alg_name, "hmac(sha1)"); >> ... >> : if (setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tmp, sizeof(tmp)) < 0) >> >> Could you check that what I suppose is failing, is actually failing? >> [dima@Mindolluin linux-master]$ grep -e '\<CONFIG_CRYPTO_SHA1\>' -e >> '\<CONFIG_CRYPTO_HMAC\>' .config >> CONFIG_CRYPTO_HMAC=y >> CONFIG_CRYPTO_SHA1=y > > FWIW the config used is uploaded with the results. If you click on > the remote it should take you to a location like this: > > https://netdev-2.bots.linux.dev/vmksft-tcp-ao/results/435369/ > > and there should be a config file in there. > >> If that's the case, I'll add the detection for hashing algorithms to >> lib/kconfig.c (together with a patch for >> tools/testing/selftests/net/config). >> And also heads up for key-management.c - that tries a bunch of hashing >> algorithms to check that the work and that the key rotation between >> different algorithms works: >> >> : const char *test_algos[] = { >> : "cmac(aes128)", >> : "hmac(sha1)", "hmac(sha512)", "hmac(sha384)", "hmac(sha256)", >> : "hmac(sha224)", "hmac(sha3-512)", >> : /* only if !CONFIG_FIPS */ >> : #define TEST_NON_FIPS_ALGOS 2 >> : "hmac(rmd160)", "hmac(md5)" >> : }; > > I was stuck in a meeting and I started playing around with the options > for TCP-AO :) Haha, the same: 3 hour-long meetings for today :-/ > I added these options now: > > CONFIG_CRYPTO_HMAC=y > CONFIG_CRYPTO_SHA1=y > CONFIG_CRYPTO_RMD160=y > CONFIG_IPV6=y > CONFIG_TCP_AO=y > CONFIG_TCP_MD5SIG=y > CONFIG_VETH=m > > And it looks much better! There are still some failures: > > https://netdev.bots.linux.dev/contest.html?branch=net-next-2024-01-24--18-00&executor=vmksft-tcp-ao Wow! Nice, thank you! > > I added VRF so that should hopefully take care of the MD5 skips > on the next run. But the failures of the rst-ip* tests don't look > like an obvious config problem. Yep, I'll look into this this week. Thanks, Dmitry
Two typo fixes, noticed by Mohammad's review. And a fix for an issue that got uncovered. Signed-off-by: Dmitry Safonov <dima@arista.com> --- Dmitry Safonov (2): selftests/net: Rectify key counters checks selftests/net: Clean-up double assignment Mohammad Nassiri (1): selftests/net: Argument value mismatch when calling verify_counters() .../testing/selftests/net/tcp_ao/key-management.c | 46 ++++++++++++---------- tools/testing/selftests/net/tcp_ao/lib/sock.c | 1 - 2 files changed, 26 insertions(+), 21 deletions(-) --- base-commit: 296455ade1fdcf5f8f8c033201633b60946c589a change-id: 20240118-tcp-ao-test-key-mgmt-bb51a5fe15a2 Best regards,