[LTP] [PATCH] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[Florian Schmaus]

In keyctl05, test_update_nonupdatable() verifies that
keyctl(KEYCTL_UPDATE) fails with EOPNOTSUPP on key types without an
->update() method (such as 'dns_resolver').

Commit 4e9400050683 ("keyctl05: Improve the dns_res_payload for boundary
testing") changed the dns_res_payload to a 6-byte V1 server-list header:
    { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 }

Byte 4 represents the lookup status (enum dns_lookup_status). Setting it
to 0x00 (DNS_LOOKUP_NOT_DONE) causes the kernel's dns_resolver_preparse()
(net/dns_resolver/dns_key.c) to treat it as a failed lookup:
    if ((v1->status != DNS_LOOKUP_GOOD &&
         v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) {
        if (prep->expiry == TIME64_MAX)
            prep->expiry = ktime_get_real_seconds() + 1;
    }

This sets an aggressive 1-second expiration on the key. On slower
environments, such as QEMU, more than 1 second may elapse between
add_key() and keyctl(KEYCTL_UPDATE), causing the update call in
test_update_nonupdatable() to fail with EKEYEXPIRED (127) rather than
EOPNOTSUPP:
    keyctl05.c:143: TFAIL: updating 'dns_resolver' key unexpectedly failed: EKEYEXPIRED (127)

Set status (byte 4) in dns_res_payload to 0x01 (DNS_LOOKUP_GOOD) so
that the kernel does not set a 1-second negative expiry, while still
retaining the 6-byte boundary payload check for commit acc657692aed.

Signed-off-by: Florian Schmaus <florian.schmaus@codasip.com>
---
 testcases/kernel/syscalls/keyctl/keyctl05.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/testcases/kernel/syscalls/keyctl/keyctl05.c b/testcases/kernel/syscalls/keyctl/keyctl05.c
index abc881628678..45f25fa7d366 100644
--- a/testcases/kernel/syscalls/keyctl/keyctl05.c
+++ b/testcases/kernel/syscalls/keyctl/keyctl05.c
@@ -208,8 +208,13 @@ static void do_test(unsigned int i)
 	 * the incoming data for add_key() sysdall should be not less than 6
 	 * bytes, because struct dns_server_list_v1_header is 6 bytes.
 	 * The minimum payload will be tested here for boundary testing.
+	 *
+	 * Set status (byte 4) to 0x01 (DNS_LOOKUP_GOOD) so the kernel does
+	 * not treat it as a failed lookup and set a 1s expiry (prep->expiry
+	 * = now + 1), which causes keyctl_update() to fail with EKEYEXPIRED
+	 * on slow systems (e.g., QEMU).
 	 */
-	static char dns_res_payload[] = { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 };
+	static char dns_res_payload[] = { 0x00, 0x00, 0x01, 0xff, 0x01, 0x00 };
 
 	switch (i) {
 	case 0:
-- 
2.55.0