ipsec_offload in rtnetlink.sh from ubunsu_kselftests_net fails on O/J

[Koichiro Den]

[ Impact ]

selftest: netfilter: after upstream commit 2cf567f421dbfe7e53b7e5ddee9400da10efb75d
ipsec_offload test needs its source ip written into the expected value, however the
complete patchset https://<email address hidden>/
has a more comprehensive modification so this only fixes the test for the
current status (only patch 2/3 of the patchset applied).

Found on Oracular 6.11.0-17.17 and should be found on its derivatives /
backports.

Log output:

    # selftests: net: rtnetlink.sh
    # PASS: policy routing
    ---(snip)---
    # PASS: ipsec
    # FAIL: ipsec_offload incorrect driver data
    # FAIL: ipsec_offload
    # PASS: bridge fdb get

Verbose output should be like:

    COMMAND: modprobe -q netdevsim
    COMMAND: ip x p add dir out src 192.168.123.3/24 dst 192.168.123.4/24 tmpl
proto esp src 192.168.123.3 dst 192.168.123.4 spi 9 mode transport reqid 42
    COMMAND: ip x p add dir in src 192.168.123.4/24 dst 192.168.123.3/24 tmpl
proto esp src 192.168.123.4 dst 192.168.123.3 spi 9 mode transport reqid 42
    COMMAND: ip x s add proto esp src 192.168.123.3 dst 192.168.123.4 spi 9 mode
transport reqid 42 aead rfc4106(gcm(aes))
0x3132333435363738393031323334353664636261 128 sel src 192.168.123.3/24 dst
192.168.123.4/24 offload dev eni0np1 dir out
    COMMAND: ip x s add proto esp src 192.168.123.4 dst 192.168.123.3 spi 9 mode
transport reqid 42 aead rfc4106(gcm(aes))
0x3132333435363738393031323334353664636261 128 sel src 192.168.123.4/24 dst
192.168.123.3/24 offload dev eni0np1 dir in
    COMMAND: diff /sys/kernel/debug/netdevsim/netdevsim0/ports/0//ipsec -
        2c2
    < sa[0] tx ipaddr=0x00000000 00000000 00000000 047ba8c0
    ---
    > sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
    FAIL: ipsec_offload incorrect driver data

[ Fix ]

Oracular: fixed separately
Jammy: fixed separately

[ Test Plan ]

Compiled, boot tested and auto-tested on amd64.

[ Where Problems Could Occur ]

The fix affects only the failing ipsec_offload of the netfilter test.

[Koichiro Den (koichiroden)]

From the patch series "[PATCHv2 net-next 0/3] netdevsim: better ipsec output format" (https://<email address hidden>/), only "netdevsim: copy addresses for both in and out paths" made it into the stable branches. The stable upstream update from v6.11.11 (LP#2091655) pulled it in semi-automatically, while the other two commits were skipped, just as they were in the upstream stable branch.

So, this failure is expected and not a regression. To make the test pass, we would need to pull in the other commits.

[Tim Whisonant (tswhison)]

Found on jammy:linux-gcp 5.15.0-1079.88 on instance c3d-standard-16 during 2025.02.10.

21501 00:12:29 DEBUG| [stdout] # < sa[0] tx ipaddr=0x00000000 00000000 00000000 047ba8c0
21502 00:12:29 DEBUG| [stdout] # ---
21503 00:12:29 DEBUG| [stdout] # > sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
21504 00:12:29 DEBUG| [stdout] # FAIL: ipsec_offload incorrect driver data

[Tim Whisonant (tswhison)]

Found on jammy:linux-gkeop 5.15.0-1062.70 on instance t2d-standard-4 during 2025.02.10.

21267 23:08:26 DEBUG| [stdout] # < sa[0] tx ipaddr=0x00000000 00000000 00000000 047ba8c0
21268 23:08:26 DEBUG| [stdout] # ---
21269 23:08:26 DEBUG| [stdout] # > sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
21270 23:08:26 DEBUG| [stdout] # FAIL: ipsec_offload incorrect driver data

[Tim Whisonant (tswhison)]

Found on focal:linux-gcp-tcpx 5.15.0-1031.32 on instance c3d-standard-16 during 2025.02.10.

19583 10:24:35 DEBUG| [stdout] # < sa[0] tx ipaddr=0x00000000 00000000 00000000 047ba8c0
19584 10:24:35 DEBUG| [stdout] # ---
19585 10:24:35 DEBUG| [stdout] # > sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
19586 10:24:35 DEBUG| [stdout] # FAIL: ipsec_offload incorrect driver data

[Hannah Sofie Peuckmann (hannsofie)]

Found on focal:linux-azure-5.15 5.15.0-1083.92~20.04.1 during 2025.02.10

15:43:26 DEBUG| [stdout] # 2c2
15:43:26 DEBUG| [stdout] # < sa[0] tx ipaddr=0x00000000 00000000 00000000 047ba8c0
15:43:26 DEBUG| [stdout] # ---
15:43:26 DEBUG| [stdout] # > sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
15:43:26 DEBUG| [stdout] # FAIL: ipsec_offload incorrect driver data

[GuoqingJiang (guoqingjiang)]

Found on f:linux-aws-5.15 5.15.0-1080.87~20.04.1 during 2025.02.10

19301 06:47:18 DEBUG| [stdout] # PASS: ipsec
19302 06:47:19 DEBUG| [stdout] # 2c2
19303 06:47:19 DEBUG| [stdout] # < sa[0] tx ipaddr=0x00000000 00000000 00000000 047ba8c0
19304 06:47:19 DEBUG| [stdout] # ---
19305 06:47:19 DEBUG| [stdout] # > sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
19306 06:47:19 DEBUG| [stdout] # FAIL: ipsec_offload incorrect driver data
19307 06:47:20 DEBUG| [stdout] # FAIL: ipsec_offload

[Aaron Ulises Jauregui Zepeda (aaronjauregui)]

Found on focal:linux-gcp-5.15 5.15.0-1079.88~20.04.1 during 2025.02.10

16:35:25 DEBUG| [stdout] # 2c2
16:35:25 DEBUG| [stdout] # < sa[0] tx ipaddr=0x00000000 00000000 00000000 047ba8c0
16:35:25 DEBUG| [stdout] # ---
16:35:25 DEBUG| [stdout] # > sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
16:35:25 DEBUG| [stdout] # FAIL: ipsec_offload incorrect driver data
16:35:25 DEBUG| [stdout] # FAIL: ipsec_offload

[Koichiro Den (koichiroden)]

Jammy is also in the same situation as Oracular now.
* Oracular was due to LP#2091655
* Jammy is due to LP#2095283

[Po-Hsu Lin (cypressyew)]

Hi Koichiro, thanks for checking this out.

[Stefan Bader (smb)]

The test there uses an inline text block to verify the driver data. We should modify tools/testing/selftests/net/rtnetlink.sh to expect the destination IP address to be set as well.

--- currently in 5.15 ---
SA count=2 tx=3
sa[0] tx ipaddr=0x00000000 00000000 00000000 00000000
sa[0] spi=0x00000009 proto=0x32 salt=0x61626364 crypt=1
sa[0] key=0x34333231 38373635 32313039 36353433
sa[1] rx ipaddr=0x00000000 00000000 00000000 037ba8c0
sa[1] spi=0x00000009 proto=0x32 salt=0x61626364 crypt=1
sa[1] key=0x34333231 38373635 32313039 36353433
---

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/5.15.0-138.148 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux' to 'verification-done-jammy-linux'. If the problem still exists, change the tag 'verification-needed-jammy-linux' to 'verification-failed-jammy-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux/6.11.0-24.24 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-oracular-linux' to 'verification-done-oracular-linux'. If the problem still exists, change the tag 'verification-needed-oracular-linux' to 'verification-failed-oracular-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!