<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 17 Apr 2021 at 15:17, Antony Antony <<a href="mailto:antony@phenome.org">antony@phenome.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Sat, Apr 17, 2021 at 11:03:15AM -0400, Andrew Cagney wrote:<br>
> Problem is still there :-( Anyone had some inspiration? For instance with <br>
> nsd-4.3.2-1.fc32.x86_64<br>
> <a href="https://testing.libreswan.org/v4.3-474-g9267a3fd5d-main/ikev2-55-ipseckey-06/" rel="noreferrer" target="_blank">https://testing.libreswan.org/v4.3-474-g9267a3fd5d-main/ikev2-55-ipseckey-06/</a><br>
> OUTPUT/nic.console.diff<br>
> <br>
> On Mon, 29 Mar 2021 at 10:09, Andrew Cagney <<a href="mailto:andrew.cagney@gmail.com" target="_blank">andrew.cagney@gmail.com</a>> wrote:<br>
> <br>
> Picking up an IRC discussion, I'm wondering if anyone has ideas on why DNS<br>
> isn't robust within the KVM test environment.<br>
<br>
I just pushed a minor fix. Let me see how ikev2-55-ipseckey-06 runs on<br>
testing.<br>
<br>
my last attempt to fix to dnssec tests:<br>
<a href="https://lists.libreswan.org/pipermail/swan-dev/2020-February/003660.html" rel="noreferrer" target="_blank">https://lists.libreswan.org/pipermail/swan-dev/2020-February/003660.html</a><br>
<br>
then I fixed only ikev2-55-ipseckey-01 and added namespace support.<br>
A quick look on testing shows ikev2-55-ipseckey-01 nic is not the issue <br>
anymore.<br>
<br>
ls -lt v4.3*/ikev2-55-ipseckey-01/OUTPUT/nic.console.diff<br>
all diff files are 0 bytes. which suggest my fix should work.<br>
<br>
next dnssec issue is dns key sort order.<br>
<a href="https://testing.libreswan.org/v4.3-474-g9267a3fd5d-main/ikev2-55-ipseckey-01/OUTPUT/east.console.diff" rel="noreferrer" target="_blank">https://testing.libreswan.org/v4.3-474-g9267a3fd5d-main/ikev2-55-ipseckey-01/OUTPUT/east.console.diff</a><br>
<br>
DNS tests should work in namespace too, atleast the NIC part.<br>
pubkey sorting order is a different problem.<br>
<br>
since afce9e92f nsd and unbound start is handled in swan-prep. It knows how<br>
to handle namespace vs systemctl.<br>
<br>
I recollect thinking, that we should add 10 sec while loop on nic like we do <br>
for strongswan.<br>
<br>
BTW:<br>
6e9893ef090 comment and ./testing/guestbin/start-dns.sh are in the wrong<br>
direction, however, lets see if ikev2-55-ipseckey-06 nic is stable after my <br>
fix.<br></blockquote><div><br></div><div>How so? It replaced all of:</div><div><br></div>-#once unbound work properly replace the next lines<br>+setenforce Permissive<br> nic #<br>- sed -i 's/5353/53/' /etc/nsd/nsd.conf<br>-nic #<br>- #/testing/guestbin/swan-prep --dnssec<br>-nic #<br>- setenforce Permissive<br>-nic #<br>- systemctl start nsd-keygen<br>-nic #<br>- systemctl start nsd<br>-nic #<br>- dig +short @<a href="http://127.0.0.1">127.0.0.1</a> <a href="http://road.testing.libreswan.org">road.testing.libreswan.org</a> IPSECKEY<br>-10 0 2 . AQPHFfpyJ3Ck4fMKcCH5DD/iZRKH2f0Sy6/U4M<HUGE_RAW_KEY></div><div class="gmail_quote"><br></div><div class="gmail_quote">with a small script and brief log lines:</div><div class="gmail_quote"><br>+ ../../pluto/bin/start-dns.sh<br>+starting dns<br>+digging for <a href="http://road.testing.libreswan.org">road.testing.libreswan.org</a> IPSECKEY<br>+Everything went well, including things like NXDOMAIN.<br>+Found 2 records<br></div><div class="gmail_quote"><br></div><div class="gmail_quote">Note, in particular, it removed the raw keys from dig.. The assumption is that this standalone script can be tweaked to handle namespaces (and further bloat to swan-prep can be avoided).</div><div class="gmail_quote"><br></div><div class="gmail_quote"><br></div><div class="gmail_quote"><br></div><div class="gmail_quote"><div> </div></div></div>