Hi Jakub,
On Mon, May 06, 2024 at 06:28:30AM -0700, Jakub Kicinski via Devel wrote:
On Mon, 6 May 2024 10:05:54 +0200 Antony Antony wrote:
Add IPsec tunnel, aka xfrm state, tests with ICMP flags enabled. IPv4 and IPv6, unreachable tests over xfrm/IPsec tunnels, xfrm SA with "flag icmp" set.
Doesn't seem to work:
thanks. I am looking into it. I notice two issues.
# selftests: net: xfrm_state.sh # ./xfrm_state.sh: line 91: test_: command not found # TEST: unreachable_ipv4IPv6 unreachable from router r3 [ FAIL ]
This appears to be an error from the v2 run, which was sent yesterday. The v3 patch should have superseded it.
The branch net-dev-testing/net-next-2024-05-06--12-00 contains the v2 patch. I wonder if net-dev testing recognized v3 patch.
git diff net-next-2024-05-06--12-00 net-next-2024-05-06--03-00 ./tools/testing/selftests/net/xfrm_state.sh is missing the expected one line diff in IFS.
# ./xfrm_state.sh: line 91: test_: command not found # TEST: unreachable_gw_ipv6IPv6 unreachable from IPsec gateway s2 [ FAIL ] # ./xfrm_state.sh: line 91: test_: command not found # TEST: mtu_ipv6_r2IPv6 MTU exceeded from ESP router r2 [ FAIL ] # ./xfrm_state.sh: line 91: test_: command not found # TEST: mtu_ipv6_r3IPv6 MTU exceeded router r3 [ FAIL ] not ok 1 selftests: net: xfrm_state.sh # exit=1
I suspect there is another another issue with tools/testing/selftests/net/config . It does not appear to support nftables match for ESP. Which this script assumes.
# ip netns exec ns_r2-39oUmE nft add rule inet filter FORWARD counter ip protocol esp counter log accept # # Error: Could not process rule: No such file or directory # add rule inet filter FORWARD counter ip protocol esp counter log accept # ^^^^^^
I learning vng also. I will send v4 with change to config, then I hope the test runner will pick up the latest patch.
-antony