[PATCH net-next 5/7] selftests: ovpn: wait for the TCP server key setup before traffic
flat view
COLD15d
From: Antonio Quartulli <antonio@openvpn.net>
Date: 2026-09-30 22:26:00
Subsystem:
kernel selftest framework, networking [general], openvpn data channel offload, the rest · Maintainers:
Shuah Khan, Shuah Khan, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Antonio Quartulli, Linus Torvalds
In TCP mode ovpn_add_peer() starts the server side from a background subshell that first listens for the incoming connections and then installs the data key of every peer. The subshell PID is discarded, so nothing synchronizes the test against the key installation. The sleep 5 that follows does not cover it: it elapses while "listen" is still waiting for connections, and the peers only connect in the subsequent ovpn_add_peer() iterations, so the key loop starts well after that sleep has expired. Until now the test happened to work because of the unrelated delays that ran in between. Record the PID of the background subshell and wait for it once all the peers have been registered, which is the earliest point at which "listen" can have returned. A peer that was not given a key yet would otherwise drop the server-to-client packets and make the first ping fail. Signed-off-by: Antonio Quartulli <antonio@openvpn.net> --- tools/testing/selftests/net/ovpn/common.sh | 13 +++++++++++++ .../testing/selftests/net/ovpn/test-close-socket.sh | 2 ++ tools/testing/selftests/net/ovpn/test.sh | 2 ++ 3 files changed, 17 insertions(+)
diff --git a/tools/testing/selftests/net/ovpn/common.sh b/tools/testing/selftests/net/ovpn/common.sh
index 2f7851b82343..96b40742eddf 100644
--- a/tools/testing/selftests/net/ovpn/common.sh
+++ b/tools/testing/selftests/net/ovpn/common.sh@@ -264,6 +264,7 @@ ovpn_add_peer() { 1 0 ${OVPN_ALG} 0 data64.key done }) & + OVPN_TCP_KEYS_PID=$! sleep 5 else peer_ns="ovpn_peer${1}"
@@ -281,6 +282,18 @@ ovpn_add_peer() { fi } +# In TCP mode the server accepts the peers and installs their data keys from a +# background subshell. "listen" only returns once every peer has connected, so +# the key installation necessarily runs after ovpn_add_peer() has been called +# for the last peer. Wait for that subshell to finish before generating any +# traffic, otherwise the first packets may race the key installation and get +# dropped for lack of a key. +ovpn_wait_tcp_keys() { + [ -n "${OVPN_TCP_KEYS_PID:-}" ] || return 0 + + wait "${OVPN_TCP_KEYS_PID}" +} + ovpn_compare_ntfs() { local diff_rc=0 local diff_file
diff --git a/tools/testing/selftests/net/ovpn/test-close-socket.sh b/tools/testing/selftests/net/ovpn/test-close-socket.sh
index ec9a51bbf3c9..142dc14e2606 100755
--- a/tools/testing/selftests/net/ovpn/test-close-socket.sh
+++ b/tools/testing/selftests/net/ovpn/test-close-socket.sh@@ -37,6 +37,8 @@ ovpn_prepare_network() { ovpn_cmd_ok "register peer${p} in overlay" ovpn_add_peer "${p}" done + ovpn_cmd_ok "wait for server-side key setup" ovpn_wait_tcp_keys + for p in $(seq 1 ${OVPN_NUM_PEERS}); do peer_ns="ovpn_peer${p}" ovpn_cmd_ok "set peer0 timeout for peer ${p}" \
diff --git a/tools/testing/selftests/net/ovpn/test.sh b/tools/testing/selftests/net/ovpn/test.sh
index e2e6ffdd29bb..0762fa83e4b5 100755
--- a/tools/testing/selftests/net/ovpn/test.sh
+++ b/tools/testing/selftests/net/ovpn/test.sh@@ -45,6 +45,8 @@ ovpn_prepare_network() { ovpn_cmd_ok "register peer${p} in overlay" ovpn_add_peer "${p}" done + ovpn_cmd_ok "wait for server-side key setup" ovpn_wait_tcp_keys + for p in $(seq 1 ${OVPN_NUM_PEERS}); do peer_ns="ovpn_peer${p}" ovpn_cmd_ok "set peer0 timeout for peer ${p}" \
--
2.55.0