.../testing/selftests/net/tcp_ao/key-management.c | 46 ++++++++++++---------- tools/testing/selftests/net/tcp_ao/lib/sock.c | 1 - 2 files changed, 26 insertions(+), 21 deletions(-)
Two typo fixes, noticed by Mohammad's review.
And a fix for an issue that got uncovered.
Signed-off-by: Dmitry Safonov <dima@arista.com>
---
Dmitry Safonov (2):
selftests/net: Rectify key counters checks
selftests/net: Clean-up double assignment
Mohammad Nassiri (1):
selftests/net: Argument value mismatch when calling verify_counters()
.../testing/selftests/net/tcp_ao/key-management.c | 46 ++++++++++++----------
tools/testing/selftests/net/tcp_ao/lib/sock.c | 1 -
2 files changed, 26 insertions(+), 21 deletions(-)
---
base-commit: 296455ade1fdcf5f8f8c033201633b60946c589a
change-id: 20240118-tcp-ao-test-key-mgmt-bb51a5fe15a2
Best regards,
--
Dmitry Safonov <dima@arista.com>
On Thu, 18 Jan 2024 02:51:33 +0000 Dmitry Safonov wrote: > Two typo fixes, noticed by Mohammad's review. > And a fix for an issue that got uncovered. Somewhat unrelated to these fixes but related to the tcp_ao selftests in general - could you please also add a config file so that it's easy to build a minimal kernel for running the tests? Something like: make defconfig make kvm_guest.config make tools/testing/selftests/net/tcp_ao/config should give us a suitable config. Differently put it'd be great to have a config we can pass to vmtest or virtme-ng and run the tests.
On 1/18/24 16:51, Jakub Kicinski wrote:
> On Thu, 18 Jan 2024 02:51:33 +0000 Dmitry Safonov wrote:
>> Two typo fixes, noticed by Mohammad's review.
>> And a fix for an issue that got uncovered.
>
> Somewhat unrelated to these fixes but related to the tcp_ao selftests
> in general - could you please also add a config file so that it's
> easy to build a minimal kernel for running the tests?
>
> Something like:
>
> make defconfig
> make kvm_guest.config
> make tools/testing/selftests/net/tcp_ao/config
Yep, sounds good to me.
I'll take as a base tools/testing/selftests/net/config and add any
needed config options on the top.
> should give us a suitable config. Differently put it'd be great to have
> a config we can pass to vmtest or virtme-ng and run the tests.
Will check that it works with them.
Thanks,
Dmitry
On Thu, 18 Jan 2024 17:04:25 +0000 Dmitry Safonov wrote: > > Somewhat unrelated to these fixes but related to the tcp_ao selftests > > in general - could you please also add a config file so that it's > > easy to build a minimal kernel for running the tests? > > > > Something like: > > > > make defconfig > > make kvm_guest.config > > make tools/testing/selftests/net/tcp_ao/config > > Yep, sounds good to me. > I'll take as a base tools/testing/selftests/net/config and add any > needed config options on the top. You probably want something smaller to be honest. tools/testing/selftests/net/config has a lot of stuff in it and it's actually missing a lot more. I'm working thru adding the missing options to tools/testing/selftests/net/config right now so far I got: # tun / tap +CONFIG_TUN=y +CONFIG_MACVLAN=y +CONFIG_MACVTAP=y +CONFIG_NET_SCH_FQ_CODEL=m +# l2tp +CONFIG_L2TP=m +CONFIG_L2TP_V3=y +CONFIG_L2TP_IP=m +CONFIG_L2TP_ETH=m +# sctp-vrf (need SCTP_DIAG to appear) +CONFIG_INET_DIAG=y +# txtimestamp +CONFIG_NET_CLS_U32=m +# test-vxlan-mdb-sh etc. +CONFIG_BRIDGE_VLAN_FILTERING=y +# gre_gso.sh etc. +CONFIG_NET_IPGRE_DEMUX=m +CONFIG_IP_GRE=m +CONFIG_IPV6_GRE=m +# ./srv6_end_dt*_l3vpn_test.sh +CONFIG_IPV6_SEG6_LWTUNNEL=y +# local port something.. +CONFIG_MPTCP=y +# fib_test.sh +CONFIG_NET_CLS_BASIC=m
On 1/18/24 17:13, Jakub Kicinski wrote:
> On Thu, 18 Jan 2024 17:04:25 +0000 Dmitry Safonov wrote:
>>> Somewhat unrelated to these fixes but related to the tcp_ao selftests
>>> in general - could you please also add a config file so that it's
>>> easy to build a minimal kernel for running the tests?
>>>
>>> Something like:
>>>
>>> make defconfig
>>> make kvm_guest.config
>>> make tools/testing/selftests/net/tcp_ao/config
>>
>> Yep, sounds good to me.
>> I'll take as a base tools/testing/selftests/net/config and add any
>> needed config options on the top.
>
> You probably want something smaller to be honest.
> tools/testing/selftests/net/config has a lot of stuff in it
> and it's actually missing a lot more. I'm working thru adding
> the missing options to tools/testing/selftests/net/config
> right now so far I got:
Thanks!
I'll send a patch for it in version 2 (as I anyway need to address
Simon's feedback).
>
> # tun / tap
> +CONFIG_TUN=y
> +CONFIG_MACVLAN=y
> +CONFIG_MACVTAP=y
> +CONFIG_NET_SCH_FQ_CODEL=m
> +# l2tp
> +CONFIG_L2TP=m
> +CONFIG_L2TP_V3=y
> +CONFIG_L2TP_IP=m
> +CONFIG_L2TP_ETH=m
> +# sctp-vrf (need SCTP_DIAG to appear)
> +CONFIG_INET_DIAG=y
> +# txtimestamp
> +CONFIG_NET_CLS_U32=m
> +# test-vxlan-mdb-sh etc.
> +CONFIG_BRIDGE_VLAN_FILTERING=y
> +# gre_gso.sh etc.
> +CONFIG_NET_IPGRE_DEMUX=m
> +CONFIG_IP_GRE=m
> +CONFIG_IPV6_GRE=m
> +# ./srv6_end_dt*_l3vpn_test.sh
> +CONFIG_IPV6_SEG6_LWTUNNEL=y
> +# local port something..
> +CONFIG_MPTCP=y
> +# fib_test.sh
> +CONFIG_NET_CLS_BASIC=m
Thanks,
Dmitry
On Fri, 19 Jan 2024 18:39:14 +0000 Dmitry Safonov wrote: > > You probably want something smaller to be honest. > > tools/testing/selftests/net/config has a lot of stuff in it > > and it's actually missing a lot more. I'm working thru adding > > the missing options to tools/testing/selftests/net/config > > right now so far I got: > > Thanks! > > I'll send a patch for it in version 2 (as I anyway need to address > Simon's feedback). Hi Dmitry! I put TCP_AO and VETH in the config and the tests seem to fail with selftests: net/tcp_ao: rst_ipv4 not ok 1 # error 834[lib/kconfig.c:143] Failed to initialize kconfig 2: No such file or directory # Planned tests != run tests (0 != 1) # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:1 The script does: target=net/tcp_ao make mrproper vng -v -b -f tools/testing/selftests/$target # build the scripts make headers make -C tools/testing/selftests/$target vng -v -r arch/x86/boot/bzImage --user root # inside the VM make -C tools/testing/selftests TARGETS=$target run_tests
Hi Jakub,
On 1/24/24 15:12, Jakub Kicinski wrote:
> On Fri, 19 Jan 2024 18:39:14 +0000 Dmitry Safonov wrote:
>>> You probably want something smaller to be honest.
>>> tools/testing/selftests/net/config has a lot of stuff in it
>>> and it's actually missing a lot more. I'm working thru adding
>>> the missing options to tools/testing/selftests/net/config
>>> right now so far I got:
>>
>> Thanks!
>>
>> I'll send a patch for it in version 2 (as I anyway need to address
>> Simon's feedback).
>
> Hi Dmitry!
>
> I put TCP_AO and VETH in the config and the tests seem to fail with
Thanks for wiring it up and for https://netdev.bots.linux.dev/status.html!
> selftests: net/tcp_ao: rst_ipv4
> not ok 1 # error 834[lib/kconfig.c:143] Failed to initialize kconfig 2: No such file or directory
> # Planned tests != run tests (0 != 1)
> # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:1
Hehe, yeah I wanted to detect kernels with !CONFIG_TCP_AO, to SKIP the
test, rather than FAIL it, which this lib/kconfig.c does.
But from a glance, I think it's failing in your run because there are
checks with and without TCP_AO, but I didn't think of checking for
the hashing algorithms support.
I think what happens is has_tcp_ao():
: strcpy(tmp.alg_name, "hmac(sha1)");
...
: if (setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tmp, sizeof(tmp)) < 0)
Could you check that what I suppose is failing, is actually failing?
[dima@Mindolluin linux-master]$ grep -e '\<CONFIG_CRYPTO_SHA1\>' -e
'\<CONFIG_CRYPTO_HMAC\>' .config
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_SHA1=y
If that's the case, I'll add the detection for hashing algorithms to
lib/kconfig.c (together with a patch for
tools/testing/selftests/net/config).
And also heads up for key-management.c - that tries a bunch of hashing
algorithms to check that the work and that the key rotation between
different algorithms works:
: const char *test_algos[] = {
: "cmac(aes128)",
: "hmac(sha1)", "hmac(sha512)", "hmac(sha384)", "hmac(sha256)",
: "hmac(sha224)", "hmac(sha3-512)",
: /* only if !CONFIG_FIPS */
: #define TEST_NON_FIPS_ALGOS 2
: "hmac(rmd160)", "hmac(md5)"
: };
> The script does:
>
> target=net/tcp_ao
> make mrproper
>
> vng -v -b -f tools/testing/selftests/$target
> # build the scripts
> make headers
> make -C tools/testing/selftests/$target
>
> vng -v -r arch/x86/boot/bzImage --user root
> # inside the VM
> make -C tools/testing/selftests TARGETS=$target run_tests
Thanks,
Dmitry
On Wed, 24 Jan 2024 17:46:10 +0000 Dmitry Safonov wrote:
> >> Thanks!
> >>
> >> I'll send a patch for it in version 2 (as I anyway need to address
> >> Simon's feedback).
> >
> > Hi Dmitry!
> >
> > I put TCP_AO and VETH in the config and the tests seem to fail with
>
> Thanks for wiring it up and for https://netdev.bots.linux.dev/status.html!
>
> > selftests: net/tcp_ao: rst_ipv4
> > not ok 1 # error 834[lib/kconfig.c:143] Failed to initialize kconfig 2: No such file or directory
> > # Planned tests != run tests (0 != 1)
> > # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:1
>
> Hehe, yeah I wanted to detect kernels with !CONFIG_TCP_AO, to SKIP the
> test, rather than FAIL it, which this lib/kconfig.c does.
> But from a glance, I think it's failing in your run because there are
> checks with and without TCP_AO, but I didn't think of checking for
> the hashing algorithms support.
>
> I think what happens is has_tcp_ao():
> : strcpy(tmp.alg_name, "hmac(sha1)");
> ...
> : if (setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tmp, sizeof(tmp)) < 0)
>
> Could you check that what I suppose is failing, is actually failing?
> [dima@Mindolluin linux-master]$ grep -e '\<CONFIG_CRYPTO_SHA1\>' -e
> '\<CONFIG_CRYPTO_HMAC\>' .config
> CONFIG_CRYPTO_HMAC=y
> CONFIG_CRYPTO_SHA1=y
FWIW the config used is uploaded with the results. If you click on
the remote it should take you to a location like this:
https://netdev-2.bots.linux.dev/vmksft-tcp-ao/results/435369/
and there should be a config file in there.
> If that's the case, I'll add the detection for hashing algorithms to
> lib/kconfig.c (together with a patch for
> tools/testing/selftests/net/config).
> And also heads up for key-management.c - that tries a bunch of hashing
> algorithms to check that the work and that the key rotation between
> different algorithms works:
>
> : const char *test_algos[] = {
> : "cmac(aes128)",
> : "hmac(sha1)", "hmac(sha512)", "hmac(sha384)", "hmac(sha256)",
> : "hmac(sha224)", "hmac(sha3-512)",
> : /* only if !CONFIG_FIPS */
> : #define TEST_NON_FIPS_ALGOS 2
> : "hmac(rmd160)", "hmac(md5)"
> : };
I was stuck in a meeting and I started playing around with the options
for TCP-AO :) I added these options now:
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_SHA1=y
CONFIG_CRYPTO_RMD160=y
CONFIG_IPV6=y
CONFIG_TCP_AO=y
CONFIG_TCP_MD5SIG=y
CONFIG_VETH=m
And it looks much better! There are still some failures:
https://netdev.bots.linux.dev/contest.html?branch=net-next-2024-01-24--18-00&executor=vmksft-tcp-ao
I added VRF so that should hopefully take care of the MD5 skips
on the next run. But the failures of the rst-ip* tests don't look
like an obvious config problem.
On 1/24/24 19:04, Jakub Kicinski wrote:
> On Wed, 24 Jan 2024 17:46:10 +0000 Dmitry Safonov wrote:
>>>> Thanks!
>>>>
>>>> I'll send a patch for it in version 2 (as I anyway need to address
>>>> Simon's feedback).
>>>
>>> Hi Dmitry!
>>>
>>> I put TCP_AO and VETH in the config and the tests seem to fail with
>>
>> Thanks for wiring it up and for https://netdev.bots.linux.dev/status.html!
>>
>>> selftests: net/tcp_ao: rst_ipv4
>>> not ok 1 # error 834[lib/kconfig.c:143] Failed to initialize kconfig 2: No such file or directory
>>> # Planned tests != run tests (0 != 1)
>>> # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:1
>>
>> Hehe, yeah I wanted to detect kernels with !CONFIG_TCP_AO, to SKIP the
>> test, rather than FAIL it, which this lib/kconfig.c does.
>> But from a glance, I think it's failing in your run because there are
>> checks with and without TCP_AO, but I didn't think of checking for
>> the hashing algorithms support.
>>
>> I think what happens is has_tcp_ao():
>> : strcpy(tmp.alg_name, "hmac(sha1)");
>> ...
>> : if (setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tmp, sizeof(tmp)) < 0)
>>
>> Could you check that what I suppose is failing, is actually failing?
>> [dima@Mindolluin linux-master]$ grep -e '\<CONFIG_CRYPTO_SHA1\>' -e
>> '\<CONFIG_CRYPTO_HMAC\>' .config
>> CONFIG_CRYPTO_HMAC=y
>> CONFIG_CRYPTO_SHA1=y
>
> FWIW the config used is uploaded with the results. If you click on
> the remote it should take you to a location like this:
>
> https://netdev-2.bots.linux.dev/vmksft-tcp-ao/results/435369/
>
> and there should be a config file in there.
>
>> If that's the case, I'll add the detection for hashing algorithms to
>> lib/kconfig.c (together with a patch for
>> tools/testing/selftests/net/config).
>> And also heads up for key-management.c - that tries a bunch of hashing
>> algorithms to check that the work and that the key rotation between
>> different algorithms works:
>>
>> : const char *test_algos[] = {
>> : "cmac(aes128)",
>> : "hmac(sha1)", "hmac(sha512)", "hmac(sha384)", "hmac(sha256)",
>> : "hmac(sha224)", "hmac(sha3-512)",
>> : /* only if !CONFIG_FIPS */
>> : #define TEST_NON_FIPS_ALGOS 2
>> : "hmac(rmd160)", "hmac(md5)"
>> : };
>
> I was stuck in a meeting and I started playing around with the options
> for TCP-AO :)
Haha, the same: 3 hour-long meetings for today :-/
> I added these options now:
>
> CONFIG_CRYPTO_HMAC=y
> CONFIG_CRYPTO_SHA1=y
> CONFIG_CRYPTO_RMD160=y
> CONFIG_IPV6=y
> CONFIG_TCP_AO=y
> CONFIG_TCP_MD5SIG=y
> CONFIG_VETH=m
>
> And it looks much better! There are still some failures:
>
> https://netdev.bots.linux.dev/contest.html?branch=net-next-2024-01-24--18-00&executor=vmksft-tcp-ao
Wow! Nice, thank you!
>
> I added VRF so that should hopefully take care of the MD5 skips
> on the next run. But the failures of the rst-ip* tests don't look
> like an obvious config problem.
Yep, I'll look into this this week.
Thanks,
Dmitry
© 2016 - 2025 Red Hat, Inc.