netdev - Re: [PATCH net 1/1] tc-testing: Update police test cases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 8 Jul 2021 20:17:54 +0200
From:   Davide Caratti <dcaratti@...hat.com>
To:     netdev@...r.kernel.org
Subject: Re: [PATCH net 1/1] tc-testing: Update police test cases

On Thu, Jul 08, 2021 at 09:05:03AM -0400, Jamal Hadi Salim wrote:
> On 2021-07-08 8:11 a.m., Roi Dayan wrote:
> 
> [..]
> > 
> > no. old output doesn't have the string "index" and also output of index
> > is in hex.
> > 
> > it is possible to make the old version work by allowing without index
> > and looking for either the unsigned number or hex number/
> > 
> > but why do we need the old output to work? could use the "old" version
> > of the test.
> 
> I think that would work if you assume this is only going to run
> on the same kernel. But:

in my perspective, that's already an issue (though a small one), because
somebody needs to ensure that a kernel is tested against a specific version
of iproute2. I say "small", because most probably the test will be waived
or skipped until all the changes (in iproute and kselftests) propagate.

> In this case because output json, which provides a formally parseable
> output, then very likely someone's scripts are dependent on the old
> output out there. So things have to be backward/forward compatible.
> The new output does look better.

the JSON output is something newly introduced  by this  commit, and I 
agree  it's good / sane to see 'index' and decimal printout in there,
like in other TC actions.

> Maybe one approach is to have multiple matchPattern in the tests?
> Davide?

sure, that's a possibility, but then:

> We will have to deal with support issues when someone says their
> script is broken.

that's probably something we need to care of. TC police is there since a
lot of time, so there might be users expecting no "index" and hex
printout in the human-readable format. If you use the old format
string with PRINT_FP, and the new one with PRINT_JSON, you should be
able to run tools/testing/selftests/net/forwarding/* and
tools/testing/selftests/tc-testing with the same iproute program,
with no "spoecial handling" for act_police.

WDYT?
-- 
davide