[LTP] [PATCH] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[Andrea Cervesato]

Hi Florian,


> In keyctl05, test_update_nonupdatable() verifies that
> keyctl(KEYCTL_UPDATE) fails with EOPNOTSUPP on key types without an
> ->update() method (such as 'dns_resolver').
> 
> Commit 4e9400050683 ("keyctl05: Improve the dns_res_payload for boundary
> testing") changed the dns_res_payload to a 6-byte V1 server-list header:
>     { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 }
> 
> Byte 4 represents the lookup status (enum dns_lookup_status). Setting it
> to 0x00 (DNS_LOOKUP_NOT_DONE) causes the kernel's dns_resolver_preparse()
> (net/dns_resolver/dns_key.c) to treat it as a failed lookup:
>     if ((v1->status != DNS_LOOKUP_GOOD &&
>          v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) {
>         if (prep->expiry == TIME64_MAX)
>             prep->expiry = ktime_get_real_seconds() + 1;
>     }
> 
> This sets an aggressive 1-second expiration on the key. On slower
> environments, such as QEMU, more than 1 second may elapse between
> add_key() and keyctl(KEYCTL_UPDATE), causing the update call in
> test_update_nonupdatable() to fail with EKEYEXPIRED (127) rather than
> EOPNOTSUPP:
>     keyctl05.c:143: TFAIL: updating 'dns_resolver' key unexpectedly failed: EKEYEXPIRED (127)
> 
> Set status (byte 4) in dns_res_payload to 0x01 (DNS_LOOKUP_GOOD) so
> that the kernel does not set a 1-second negative expiry, while still
> retaining the 6-byte boundary payload check for commit acc657692aed.

Good catch. I'm wondering if it makes sense to use KEYCTL_SET_TIMEOUT in
this case, but I guess we can rely on the test timeout in this case.

did you explore this option already?

Otherwise LGTM

Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com>

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com