netdev - Re: nft_flowtable.sh selftest failures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <78f95723-0c65-4060-b9d6-7e69d24da2da@redhat.com>
Date: Tue, 12 Aug 2025 09:58:11 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Pablo Neira Ayuso <pablo@...filter.org>,
 Jozsef Kadlecsik <kadlec@...filter.org>, Florian Westphal <fw@...len.de>
Cc: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
 netfilter-devel@...r.kernel.org, Jakub Kicinski <kuba@...nel.org>
Subject: Re: nft_flowtable.sh selftest failures

On 8/12/25 9:50 AM, Paolo Abeni wrote:
> the mentioned self test failed in the last 2 CI iterations, on both
> metal and debug build, with the following output:
> 
> # PASS: flow offload for ns1/ns2 with dnat and pmtu discovery ns1 <- ns2
> # Error: Requested AUTH algorithm not found.
> # Error: Requested AUTH algorithm not found.
> # Error: Requested AUTH algorithm not found.
> # Error: Requested AUTH algorithm not found.
> # FAIL: file mismatch for ns1 -> ns2
> # -rw------- 1 root root 2097152 Aug 11 20:23 /tmp/tmp.x1oVr3mu0P
> # -rw------- 1 root root 0 Aug 11 20:23 /tmp/tmp.77gElv9oit
> # FAIL: file mismatch for ns1 <- ns2
> # -rw------- 1 root root 2097152 Aug 11 20:23 /tmp/tmp.x1oVr3mu0P
> # -rw------- 1 root root 0 Aug 11 20:23 /tmp/tmp.ogDiTh8ZXf
> # FAIL: ipsec tunnel mode for ns1/ns2
> 
> see, i.e.:
> https://netdev-3.bots.linux.dev/vmksft-nf/results/249461/14-nft-flowtable-sh/
> 
> I don't see relevant patches landing in the relevant builds, I suspect
> the relevant kernel config knob (CONFIG_CRYPTO_SHA1 ?) was always
> missing in the ST config, pulled in by NIPA due to some CI setup tweak
> possibly changed recently (Jakub could possibly have a better idea/view
> about the latter). Could you please have a look?
> 
> NIPA generates the kernel config and the kernel build itself with
> something alike:
> 
> rm -f .config
> vng --build  --config tools/testing/selftests/net/forwarding/config

Addendum: others (not nft-related) tests (vrf-xfrm-tests.sh,
xfrm_policy.sh) are failing apparently due to the same root cause
(missing sha1 knob), so I guess it's really a NIPA issue.

/P