Repository navigation
packetdrill: psp: support device (master) key rotation - #102
Conversation
Only record script to live spi mappings when the rx-assoc netlink call
succeeded. Some tests may wish to use psp_rx_assoc() with an expected
error. For example:
+0 psp_rx_assoc(4, [7]) = 0
+0 psp_rx_assoc(4, [8]) = -1 EBUSY (Device or resource busy)
The second call is an expected failure. Packetdrill should validate its
result and errno without adding script SPI 8 to the translation table.
Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
Add support for psp key-rotate netlink op. This doesn't take a psp dev id, because at startup, packetdrill resolves the wire interface ifindex to a psp dev id, and then uses that. Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
| // Second rotation: the spi + key pair is not valid. | ||
| +0 psp_key_rotate() = 0 | ||
|
|
||
| // The device drops the segment, so it is never queued to the socket and no |
There was a problem hiding this comment.
very minor: exact error handling is not defined. IMHO devices should never drop packets, but pass them to the software stack (e.g., for monitoring purposes), just clearly marked as invalid.
Either way, the packet will be dropped before it reaches the socket, indeed, as it is not a valid decrypted PSP packet.
Same comment also applies to the file comment at the top.
There was a problem hiding this comment.
That's a good call out. Let me respin. Thanks
Add basic tests for key rotation. In general, a PSP connection can survive at most one key rotation without rekeying before losing Rx connectivity. Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
0474563 to
8b7ddd2
Compare
|
Thanks Daniel! LGTM. It builds cleanly with and without ENABLE_PSP, and the behavior matches psp_assocs_key_rotated() and mlx5. Patch 1 is a good catch: it was recording an uninitialized live SPI/key whenever a failure was expected. An optional suggestion for psp-key-rotate-disconnect.pkt if you have time to post a follow-up: In gtests/net/psp/psp-key-rotate-disconnect.pkt the “no ACK is generated” claim isn’t actually checked, because packetdrill only looks at outbound packets when it reaches a later > line. Ending with something like the following would check that no ACK is generated: The next segment we send must be our Thanks! |
Hello,
This series adds support for psp device (master) key rotation in packetdrill and demonstrates usage in some test cases.
I plan to submit a series to linux net-next to support rekeying PSP connections. To accompany that series, I have a set of packetdrill tests here: danieldzahka@9ff7cf9. These tests feature key rotations, as that is the primary reason to rekey a connection.
The first commit is a bit unrelated, but it was a psp netlink fix that I had in my tree, so I figured I would just include it. I can send that separately if needed.
Tested on two hosts, each with PSP capable cx7's using mlx5 driver with linux 6.19.