<div dir="ltr">BTW, I took a look at swan-prep --dnssec. As best I can the big difference between namespaces and KVM is when the config files are installed:<div><br></div><div>- with KVMs the nsd and unbound directories are set up before the test is run (during transmogrify)</div><div>- with namespaces, the nsd and unbound directories are set up as part of some interesting mounts by swan-prep</div><div><br></div><div>would things be more straight forward if, for namespaces, the directories were set up behind the scenes before the test starts (I'm mainly thinking of those mounts trying to hide stuff and/or provide a scratch space for test specific files)? That way namespaces and KVM would better resemble each other without the need to involve swan-prep.</div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 17 Apr 2021 at 19:55, Andrew Cagney <<a href="mailto:andrew.cagney@gmail.com">andrew.cagney@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 17 Apr 2021 at 15:17, Antony Antony <<a href="mailto:antony@phenome.org" target="_blank">antony@phenome.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Sat, Apr 17, 2021 at 11:03:15AM -0400, Andrew Cagney wrote:<br>
> Problem is still there :-( Anyone had some inspiration? For instance with <br>
> nsd-4.3.2-1.fc32.x86_64<br>
> <a href="https://testing.libreswan.org/v4.3-474-g9267a3fd5d-main/ikev2-55-ipseckey-06/" rel="noreferrer" target="_blank">https://testing.libreswan.org/v4.3-474-g9267a3fd5d-main/ikev2-55-ipseckey-06/</a><br>
> OUTPUT/nic.console.diff<br>
> <br>
> On Mon, 29 Mar 2021 at 10:09, Andrew Cagney <<a href="mailto:andrew.cagney@gmail.com" target="_blank">andrew.cagney@gmail.com</a>> wrote:<br>
> <br>
> Picking up an IRC discussion, I'm wondering if anyone has ideas on why DNS<br>
> isn't robust within the KVM test environment.<br>
<br>
I just pushed a minor fix. Let me see how ikev2-55-ipseckey-06 runs on<br>
testing.<br>
<br>
my last attempt to fix to dnssec tests:<br>
<a href="https://lists.libreswan.org/pipermail/swan-dev/2020-February/003660.html" rel="noreferrer" target="_blank">https://lists.libreswan.org/pipermail/swan-dev/2020-February/003660.html</a><br>
<br>
then I fixed only ikev2-55-ipseckey-01 and added namespace support.<br>
A quick look on testing shows ikev2-55-ipseckey-01 nic is not the issue <br>
anymore.<br>
<br>
ls -lt v4.3*/ikev2-55-ipseckey-01/OUTPUT/nic.console.diff<br>
all diff files are 0 bytes. which suggest my fix should work.<br>
<br>
next dnssec issue is dns key sort order.<br>
<a href="https://testing.libreswan.org/v4.3-474-g9267a3fd5d-main/ikev2-55-ipseckey-01/OUTPUT/east.console.diff" rel="noreferrer" target="_blank">https://testing.libreswan.org/v4.3-474-g9267a3fd5d-main/ikev2-55-ipseckey-01/OUTPUT/east.console.diff</a><br>
<br>
DNS tests should work in namespace too, atleast the NIC part.<br>
pubkey sorting order is a different problem.<br>
<br>
since afce9e92f nsd and unbound start is handled in swan-prep. It knows how<br>
to handle namespace vs systemctl.<br>
<br>
I recollect thinking, that we should add 10 sec while loop on nic like we do <br>
for strongswan.<br>
<br>
BTW:<br>
6e9893ef090 comment and ./testing/guestbin/start-dns.sh are in the wrong<br>
direction, however, lets see if ikev2-55-ipseckey-06 nic is stable after my <br>
fix.<br></blockquote><div><br></div><div>How so? It replaced all of:</div><div><br></div>-#once unbound work properly replace the next lines<br>+setenforce Permissive<br> nic #<br>- sed -i 's/5353/53/' /etc/nsd/nsd.conf<br>-nic #<br>- #/testing/guestbin/swan-prep --dnssec<br>-nic #<br>- setenforce Permissive<br>-nic #<br>- systemctl start nsd-keygen<br>-nic #<br>- systemctl start nsd<br>-nic #<br>- dig +short @<a href="http://127.0.0.1" target="_blank">127.0.0.1</a> <a href="http://road.testing.libreswan.org" target="_blank">road.testing.libreswan.org</a> IPSECKEY<br>-10 0 2 . AQPHFfpyJ3Ck4fMKcCH5DD/iZRKH2f0Sy6/U4M<HUGE_RAW_KEY></div><div class="gmail_quote"><br></div><div class="gmail_quote">with a small script and brief log lines:</div><div class="gmail_quote"><br>+ ../../pluto/bin/start-dns.sh<br>+starting dns<br>+digging for <a href="http://road.testing.libreswan.org" target="_blank">road.testing.libreswan.org</a> IPSECKEY<br>+Everything went well, including things like NXDOMAIN.<br>+Found 2 records<br></div><div class="gmail_quote"><br></div><div class="gmail_quote">Note, in particular, it removed the raw keys from dig.. The assumption is that this standalone script can be tweaked to handle namespaces (and further bloat to swan-prep can be avoided).</div><div class="gmail_quote"><br></div><div class="gmail_quote"><br></div><div class="gmail_quote"><br></div><div class="gmail_quote"><div> </div></div></div>
</blockquote></div>