[macsec] Add dirty-restart SAK regression test - #24903
Conversation
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
mssonicbld
added
the
Request for 202511 branch
|
This PR has backport request for branch(es): 202511. ---Powered by SONiC BuildBot
|
ea05a97 to
256d33d
Compare
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
256d33d to
d5bf043
Compare
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
@rawal01 : can you help review this ? |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
@saksarav-nokia to review/sign-off. |
| that an advance-timeout error mid-test can't leak a non-zero rekey_period | ||
| into the next profile's run. | ||
| """ | ||
| duthost = rand_selected_dut |
There was a problem hiding this comment.
Tests use rand_selected_dut, but ctrl_links is built from macsec_duthost.
test_docker_restart.py uses the explicit pattern:
duthost = duthosts[enum_rand_one_per_hwsku_macsec_frontend_hostname]
So it is better to use macsec_duthost (or the same enum fixture) in both tests and in force_dut_key_server / macsec_loganalyzer_ignore, so kills and DB checks run on the DUT that actually owns the MACsec ctrl links.
There was a problem hiding this comment.
Pushed a commit to address this, please review.
fa30417 to
242a523
Compare
|
/azp run |
|
Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command. |
242a523 to
60d3b4f
Compare
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
|
@saksarav-nokia please review the latest diffs. |
09310f2
60d3b4f to
09310f2
Compare
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
09310f2 to
4016614
Compare
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
4016614 to
6a4ff4a
Compare
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Signed-off-by: senthil-nexthop <senthil@nexthop.ai>
6a4ff4a to
0ce91d0
Compare
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
|
This PR has backport request label(s) for branch(es): 202511, but is missing required test information. Please make sure you tick the tested branch(es) in the Tested branch section and provide test evidence (e.g., 202511: <test result>) in the Test result section as well in your PR description. ---Powered by SONiC BuildBot
|
|
This PR has backport request label(s) for branch(es): 202605, but is missing required test information. Please make sure you tick the tested branch(es) in the Tested branch section and provide test evidence (e.g., 202605: <test result>) in the Test result section as well in your PR description. ---Powered by SONiC BuildBot
|
6 participants
Description of PR
Add a new dirty-restart regression test for MACsec that catches the stale-SAK class of bug (
docker kill -s 9 macsec→ MKA renegotiates → orchagent silently keeps the prior cycle's SAK in SAI).The existing
tests/macsec/test_docker_restart.py(gracefulsystemctl restart macsecsmoke test) is untouched — its historical pass/fail data continues to flow into the test-results system unchanged.Companion fix: stale-sak (recover from stale-SAK after dirty macsec docker restart).
Type of change
Back port request
Approach
What is the motivation for this PR?
The existing
test_docker_restartis a gracefulsystemctl restart— macsecmgrd gets to disable MACsec on each port before the container goes down, so re-keying after restart works fine. The bug class fixed in stale-sak only triggers when the container dies without the graceful per-port teardown — e.g.docker kill -s 9, OOM-kill, host reset, panic. A separate "dirty" test exercises that path.How did you do it?
Lives in a new
tests/macsec/test_macsec_recovery.py, with shared disrupt / wait / snapshot / assert helpers in a newtests/common/macsec/recovery_helpers.py.How did you verify/test it?
test_dirty_container_kill_preserves_sak_consistencyPASSED:128,128_SCI,128_XPN,128_XPN_SCI,256,256_SCI,256_XPN,256_XPN_SCI,MACSEC_PROFILE.assert_appl_db_sak_matches_show_macsecfailure (APPL_DB advertised the renegotiated key whileshow macsecstill showed the prior cycle's SAK on at least one port).python3 -m astparse on both new files.