diff --git a/src/libimcv/imv/data.sql b/src/libimcv/imv/data.sql index 88e1e330f..b15b4c111 100644 --- a/src/libimcv/imv/data.sql +++ b/src/libimcv/imv/data.sql @@ -622,6 +622,12 @@ INSERT INTO products ( /* 104 */ 'Debian 12 x86_64' ); +INSERT INTO products ( /* 105 */ + name +) VALUES ( + 'Debian 13 x86_64' +); + /* Directories */ INSERT INTO directories ( /* 1 */ @@ -1708,6 +1714,12 @@ INSERT INTO groups_product_defaults ( 17, 104 ); +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 17, 105 +); + /* Policies */ INSERT INTO policies ( /* 1 */ diff --git a/src/libstrongswan/utils/leak_detective.c b/src/libstrongswan/utils/leak_detective.c index 038cd0a0c..1ae19fd96 100644 --- a/src/libstrongswan/utils/leak_detective.c +++ b/src/libstrongswan/utils/leak_detective.c @@ -617,6 +617,7 @@ static char *whitelist[] = { "OSSL_DECODER_CTX_new_for_pkey", "OSSL_ENCODER_do_all_provided", "OSSL_PROVIDER_try_load", + "OSSL_PROVIDER_try_load_ex", "OSSL_PROVIDER_load", "RAND_get0_private", "RAND_get0_public", diff --git a/testing/config/kvm/alice.xml b/testing/config/kvm/alice.xml index 9cdb25166..d1212665e 100644 --- a/testing/config/kvm/alice.xml +++ b/testing/config/kvm/alice.xml @@ -1,8 +1,8 @@ alice 1f35c25d-6a7b-4ee1-2461-d7e530e7b2a9 - 200 - 200 + 260 + 260 1 hvm diff --git a/testing/config/kvm/bob.xml b/testing/config/kvm/bob.xml index 982a1aac0..b55bf8ca2 100644 --- a/testing/config/kvm/bob.xml +++ b/testing/config/kvm/bob.xml @@ -1,8 +1,8 @@ bob 72728516-377f-f5be-ea1d-b1f1e851538f - 128 - 128 + 150 + 150 1 hvm diff --git a/testing/config/kvm/carol.xml b/testing/config/kvm/carol.xml index 33dc08adc..60c15350d 100644 --- a/testing/config/kvm/carol.xml +++ b/testing/config/kvm/carol.xml @@ -1,8 +1,8 @@ carol 6bc2eef5-7faf-cde0-5f27-6fc29f93bc3d - 128 - 128 + 150 + 150 1 hvm diff --git a/testing/config/kvm/dave.xml b/testing/config/kvm/dave.xml index 93ce82e63..e9402b4fb 100644 --- a/testing/config/kvm/dave.xml +++ b/testing/config/kvm/dave.xml @@ -1,8 +1,8 @@ dave 05f1debe-4e38-4f3d-10a0-c07fbb70d816 - 128 - 128 + 150 + 150 1 hvm diff --git a/testing/config/kvm/moon.xml b/testing/config/kvm/moon.xml index df77348d0..e2271384c 100644 --- a/testing/config/kvm/moon.xml +++ b/testing/config/kvm/moon.xml @@ -1,8 +1,8 @@ moon b5e00ad3-1c81-3b2a-7f66-cdf8727b3c65 - 128 - 128 + 150 + 150 4 hvm diff --git a/testing/config/kvm/sun.xml b/testing/config/kvm/sun.xml index 68c160a80..b76ff3541 100644 --- a/testing/config/kvm/sun.xml +++ b/testing/config/kvm/sun.xml @@ -1,8 +1,8 @@ sun 35341843-346c-a63a-786b-9df0fd5e6264 - 144 - 144 + 150 + 150 2 hvm diff --git a/testing/config/kvm/venus.xml b/testing/config/kvm/venus.xml index 07e1b995d..ca1369584 100644 --- a/testing/config/kvm/venus.xml +++ b/testing/config/kvm/venus.xml @@ -1,8 +1,8 @@ venus f0838df9-7cc0-84f5-6c14-2d16ab002e8d - 128 - 128 + 150 + 150 1 hvm diff --git a/testing/config/kvm/winnetou.xml b/testing/config/kvm/winnetou.xml index aa259d06f..89c07b981 100644 --- a/testing/config/kvm/winnetou.xml +++ b/testing/config/kvm/winnetou.xml @@ -1,8 +1,8 @@ winnetou b1d3d2f7-e20b-ab95-277e-66d4cac33cc3 - 160 - 160 + 200 + 200 1 hvm diff --git a/testing/do-tests b/testing/do-tests index 33f946a2e..8d63477ef 100755 --- a/testing/do-tests +++ b/testing/do-tests @@ -59,11 +59,13 @@ function usage() cat << EOF Usage: ${0##*/} [-h] [-v|-t] [-i|-e] [TESTDIRS] - --help (-h) show usage information - --verbose (-v) show complete logs on errors (implies -t) - --timestamps (-t) show timestamps in console.log - --pre (-i) run pretest script only (single test only) - --post (-e) run posttest script only (single test only) + --help (-h) show usage information + --verbose (-v) show complete logs on errors (implies -t) + --timestamps (-t) show timestamps in console.log + --pre (-i) run pretest script only (single test only) + --post (-e) run posttest script only (single test only) + --no-leaks [daemon] (-n) disable leak detective in commands (e.g. swanctl) + and optionally the daemon as well TESTDIRS list of test directories (relative to testing/tests). wildcards (*) are supported. default is to run all tests. @@ -91,6 +93,13 @@ while [ $# -gt 0 ]; do -e|--post) posttest_only=YES ;; + -n|--no-leaks) + export LEAK_DETECTIVE_DISABLE=1 + if [[ "$2" =~ d(aemon)? ]]; then + export LEAK_DETECTIVE_DISABLE_DAEMON=1 + shift + fi + ;; *) TESTDIRS+=("$1") ;; diff --git a/testing/hosts/default/etc/rsyslog.conf b/testing/hosts/default/etc/rsyslog.conf index 9f76da36e..ee0a324d1 100644 --- a/testing/hosts/default/etc/rsyslog.conf +++ b/testing/hosts/default/etc/rsyslog.conf @@ -119,7 +119,7 @@ news.notice -/var/log/news/news.notice # NOTE: adjust the list below, or you'll go crazy if you have a reasonably # busy site.. # -daemon.*;mail.*;\ - news.err;\ - *.=debug;*.=info;\ - *.=notice;*.=warn |/dev/xconsole +#daemon.*;mail.*;\ +# news.err;\ +# *.=debug;*.=info;\ +# *.=notice;*.=warn |/dev/xconsole diff --git a/testing/hosts/default/etc/ssh/sshd_config b/testing/hosts/default/etc/ssh/sshd_config index bed9e8238..cfe0444c3 100644 --- a/testing/hosts/default/etc/ssh/sshd_config +++ b/testing/hosts/default/etc/ssh/sshd_config @@ -12,5 +12,6 @@ PrintMotd no PrintLastLog no UsePAM no AcceptEnv LANG LC_* -AcceptEnv LEAK_DETECTIVE_LOG +AcceptEnv LEAK_DETECTIVE_* +SetEnv LEAK_DETECTIVE_IGNORE_UNKNOWN=1 Subsystem sftp /usr/lib/openssh/sftp-server diff --git a/testing/hosts/default/etc/sysctl.conf b/testing/hosts/default/etc/sysctl.conf deleted file mode 100644 index 364b64ad6..000000000 --- a/testing/hosts/default/etc/sysctl.conf +++ /dev/null @@ -1,62 +0,0 @@ -# -# /etc/sysctl.conf - Configuration file for setting system variables -# See /etc/sysctl.d/ for additional system variables -# See sysctl.conf (5) for information. -# - -#kernel.domainname = example.com - -# Uncomment the following to stop low-level messages on console -#kernel.printk = 3 4 1 3 - -##############################################################3 -# Functions previously found in netbase -# - -# Uncomment the next two lines to enable Spoof protection (reverse-path filter) -# Turn on Source Address Verification in all interfaces to -# prevent some spoofing attacks -#net.ipv4.conf.default.rp_filter=1 -#net.ipv4.conf.all.rp_filter=1 - -# Uncomment the next line to enable TCP/IP SYN cookies -# See http://lwn.net/Articles/277146/ -# Note: This may impact IPv6 TCP sessions too -#net.ipv4.tcp_syncookies=1 - -# Uncomment the next line to enable packet forwarding for IPv4 -net.ipv4.ip_forward=1 - -# Uncomment the next line to enable packet forwarding for IPv6 -# Enabling this option disables Stateless Address Autoconfiguration -# based on Router Advertisements for this host -net.ipv6.conf.all.forwarding=1 - - -################################################################### -# Additional settings - these settings can improve the network -# security of the host and prevent against some network attacks -# including spoofing attacks and man in the middle attacks through -# redirection. Some network environments, however, require that these -# settings are disabled so review and enable them as needed. -# -# Do not accept ICMP redirects (prevent MITM attacks) -#net.ipv4.conf.all.accept_redirects = 0 -#net.ipv6.conf.all.accept_redirects = 0 -# _or_ -# Accept ICMP redirects only for gateways listed in our default -# gateway list (enabled by default) -# net.ipv4.conf.all.secure_redirects = 1 -# -# Do not send ICMP redirects (we are not a router) -#net.ipv4.conf.all.send_redirects = 0 -# -# Do not accept IP source route packets (we are not a router) -#net.ipv4.conf.all.accept_source_route = 0 -#net.ipv6.conf.all.accept_source_route = 0 -# -# Log Martian Packets -#net.ipv4.conf.all.log_martians = 1 - -# Enable coredump for suid binaries -fs.suid_dumpable = 1 diff --git a/testing/hosts/default/etc/sysctl.d/99-strongswan.conf b/testing/hosts/default/etc/sysctl.d/99-strongswan.conf new file mode 100644 index 000000000..c21ce4195 --- /dev/null +++ b/testing/hosts/default/etc/sysctl.d/99-strongswan.conf @@ -0,0 +1,16 @@ +# Enable packet forwarding for IPv4 +net.ipv4.ip_forward=1 + +# Enable packet forwarding for IPv6 +# Enabling this option disables Stateless Address Autoconfiguration +# based on Router Advertisements for this host +net.ipv6.conf.all.forwarding=1 + +# Enable coredump for suid binaries +fs.suid_dumpable = 1 + +# As we run with very little memory, use the old default to reduce overhead +vm.max_map_count = 65530 + +# Allow overcommitting, in particular for forks +vm.overcommit_memory = 1 diff --git a/testing/hosts/default/etc/systemd/system.conf.d/99-ignore-unknown-memory.conf b/testing/hosts/default/etc/systemd/system.conf.d/99-ignore-unknown-memory.conf new file mode 100644 index 000000000..acf2eee6d --- /dev/null +++ b/testing/hosts/default/etc/systemd/system.conf.d/99-ignore-unknown-memory.conf @@ -0,0 +1,2 @@ +[Manager] +DefaultEnvironment=LEAK_DETECTIVE_IGNORE_UNKNOWN=1 diff --git a/testing/hosts/default/usr/local/bin/service b/testing/hosts/default/usr/local/bin/service index c5db4f61b..0182f0b84 100755 --- a/testing/hosts/default/usr/local/bin/service +++ b/testing/hosts/default/usr/local/bin/service @@ -3,15 +3,20 @@ # LEAK_DETECTIVE_LOG is set for automated runs, however, `service` strips # the environment. This wrapper is used to set the variable for the charon # init script. +# Similar for LEAK_DETECTIVE_DISABLE. However, we don't pass that along +# directly, to be able to run the daemon with it while still improving the +# performance when collecting results etc. ORIG=/usr/sbin/service -CONF=/etc/default/charon +CONF=/etc/default/charon-tkm -if [[ "$1" != "charon" ]]; then +if [[ "$1" != "charon-tkm" ]]; then $ORIG "$@" fi -if [[ "$2" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then +if [[ "$2" == "start" && -n $LEAK_DETECTIVE_DISABLE_DAEMON ]]; then + echo "export LEAK_DETECTIVE_DISABLE=$LEAK_DETECTIVE_DISABLE_DAEMON" >> $CONF +elif [[ "$2" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then echo "export LEAK_DETECTIVE_LOG=$LEAK_DETECTIVE_LOG" >> $CONF fi @@ -19,4 +24,5 @@ $ORIG "$@" if [[ "$2" == "stop" ]]; then sed -i '/LEAK_DETECTIVE_LOG/d' $CONF 2>/dev/null + sed -i '/LEAK_DETECTIVE_DISABLE/d' $CONF 2>/dev/null fi diff --git a/testing/hosts/default/usr/local/bin/systemctl b/testing/hosts/default/usr/local/bin/systemctl index 51e188c0e..07027508b 100755 --- a/testing/hosts/default/usr/local/bin/systemctl +++ b/testing/hosts/default/usr/local/bin/systemctl @@ -3,6 +3,9 @@ # LEAK_DETECTIVE_LOG is set for automated runs, however, this is not passed # to a process started via systemctl. This wrapper is used to set the variable # for the strongswan.service unit. +# Similar for LEAK_DETECTIVE_DISABLE. However, we don't pass that along +# directly, to be able to run the daemon with it while still improving the +# performance when collecting results etc. ORIG=/bin/systemctl CONF=/lib/systemd/system/strongswan.service @@ -11,7 +14,9 @@ if [[ "$2" != "strongswan" ]]; then exec $ORIG "$@" fi -if [[ "$1" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then +if [[ "$1" == "start" && -n $LEAK_DETECTIVE_DISABLE_DAEMON ]]; then + sed -i "s:Type=:Environment=LEAK_DETECTIVE_DISABLE=$LEAK_DETECTIVE_DISABLE_DAEMON\nType=:" $CONF 2>/dev/null +elif [[ "$1" == "start" && -n $LEAK_DETECTIVE_LOG ]]; then sed -i "s:Type=:Environment=LEAK_DETECTIVE_LOG=$LEAK_DETECTIVE_LOG\nType=:" $CONF 2>/dev/null fi @@ -20,6 +25,7 @@ STATUS=$? if [[ "$1" == "stop" ]]; then sed -i '/LEAK_DETECTIVE_LOG/d' $CONF 2>/dev/null + sed -i '/LEAK_DETECTIVE_DISABLE/d' $CONF 2>/dev/null fi exit $STATUS diff --git a/testing/hosts/default/usr/local/sbin/ipsec b/testing/hosts/default/usr/local/sbin/ipsec new file mode 100755 index 000000000..60c88274f --- /dev/null +++ b/testing/hosts/default/usr/local/sbin/ipsec @@ -0,0 +1,12 @@ +#!/bin/bash +# +# LEAK_DETECTIVE_DISABLE might be set, however, we only want to actually use +# it for the daemons if LEAK_DETECTIVE_DISABLE_DAEMON is set. + +ORIG=/usr/local/sbin/ipsec.orig + +if [[ "$1" == "start" && -z $LEAK_DETECTIVE_DISABLE_DAEMON ]]; then + unset LEAK_DETECTIVE_DISABLE +fi + +$ORIG "$@" diff --git a/testing/hosts/moon/etc/rc.local b/testing/hosts/moon/etc/rc.local deleted file mode 100755 index 8649a2bcb..000000000 --- a/testing/hosts/moon/etc/rc.local +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/sh -e -# -# rc.local -# -# This script is executed at the end of each multiuser runlevel. -# Make sure that the script will "exit 0" on success or any other -# value on error. -# -# In order to enable or disable this script just change the execution -# bits. -# - -# Disable checksum offloading on eth1 because it does not currently work with -# libvirt and isc-dhcp-server running on venus, see [1] -# [1] - https://bugs.mageia.org/show_bug.cgi?id=1243 - -ethtool --offload eth1 tx off >/dev/null 2>&1 -ethtool --offload eth1 rx off >/dev/null 2>&1 - -exit 0 diff --git a/testing/hosts/winnetou/etc/ldap/slapd.conf b/testing/hosts/winnetou/etc/ldap/slapd.conf index 2fb8d41e9..7c4fd3aca 100644 --- a/testing/hosts/winnetou/etc/ldap/slapd.conf +++ b/testing/hosts/winnetou/etc/ldap/slapd.conf @@ -7,8 +7,8 @@ moduleload back_mdb.la include /etc/ldap/schema/core.schema -pidfile /var/run/openldap/slapd.pid -argsfile /var/run/openldap/slapd.args +pidfile /var/run/slapd/slapd.pid +argsfile /var/run/slapd/slapd.args ####################################################################### # Database definitions diff --git a/testing/scripts/build-baseimage b/testing/scripts/build-baseimage index edb1588c4..8221fb86a 100755 --- a/testing/scripts/build-baseimage +++ b/testing/scripts/build-baseimage @@ -18,23 +18,11 @@ INC=$INC,libxml2-dev,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libltdl-dev,wget,gnupg,man-db INC=$INC,libboost-thread-dev,libboost-system-dev,git,iperf3,htop,valgrind,strace INC=$INC,gnat,gprbuild,acpid,acpi-support-base,libldns-dev,libunbound-dev -INC=$INC,dnsutils,ca-certificates,unzip,libsystemd-dev +INC=$INC,bind9-dnsutils,ca-certificates,unzip,libsystemd-dev INC=$INC,python3,python3-setuptools,python3-build,python3-dev,python3-daemon,python3-venv, INC=$INC,apt-transport-https,libjson-c-dev,libxslt1-dev,libapache2-mod-wsgi-py3 -INC=$INC,libxerces-c-dev,rsyslog,ncat,socat +INC=$INC,libxerces-c-dev,rsyslog,ncat,socat,libiptc-dev,binutils-dev case "$BASEIMGSUITE" in -buster) - INC=$INC,iptables-dev - ;; -*) - INC=$INC,libiptc-dev - ;; -esac -case "$BASEIMGSUITE" in -buster) - INC=$INC,libahven7-dev,libxmlada-schema8-dev,libgmpada8-dev - INC=$INC,libalog4-dev,dbus-user-session - ;; bullseye) INC=$INC,libahven9-dev,libxmlada-schema10-dev,libgmpada10-dev INC=$INC,libalog6-dev,dbus-user-session @@ -44,11 +32,15 @@ bullseye) ;; bookworm) INC=$INC,libahven11-dev,libxmlada-schema12-dev,libgmpada12-dev - INC=$INC,libalog8-dev,dbus-user-session + INC=$INC,libalog8-dev,dbus-user-session,pipx # workaround for dependency issue gdb -> libsource-highlight4v5 -> virtual # package (libboost-regex1.74.0-icu67), which debootstrap can't resolve (#878961) INC=$INC,libboost-regex1.74.0 ;; +trixie) + INC=$INC,libahven-dev,libxmlada-schema-dev,libgmpada-dev + INC=$INC,libalog-dev,dbus-user-session,pipx,systemd-dev + ;; *) echo_warn "Package list for '$BASEIMGSUITE' might has to be updated" ;; @@ -60,7 +52,7 @@ APT1="libgcrypt20-dev traceroute iptables" APT="tmux" # additional services to disable case "$BASEIMGSUITE" in -bookworm) +bookworm|trixie) ;; *) SERVICES="$SERVICES systemd-timesyncd" @@ -86,6 +78,9 @@ log_action "Connecting image to NBD device $NBDEV" execute "qemu-nbd -c $NBDEV $BASEIMG" do_on_exit qemu-nbd -d $NBDEV +# wait for disk to become ready with newer QEMU versions +sleep 1 + log_action "Partitioning disk" sfdisk /dev/nbd0 >>$LOGFILE 2>&1 << EOF ; @@ -125,13 +120,13 @@ EOF execute_chroot "locale-gen" log_action "Downloading signing key for custom apt repo" -execute_chroot "wget -q $BASEIMGEXTKEY -O /tmp/key" +execute_chroot "wget -q $BASEIMGEXTKEY -O /tmp/strongswan.key" log_action "Installing signing key for custom apt repo" -execute_chroot "apt-key add /tmp/key" +execute_chroot "mv /tmp/strongswan.key /etc/apt/keyrings/" log_action "Enabling custom apt repo" cat > $LOOPDIR/etc/apt/sources.list.d/strongswan.list << EOF -deb $BASEIMGEXTREPO $BASEIMGSUITE main +deb [signed-by=/etc/apt/keyrings/strongswan.key] $BASEIMGEXTREPO $BASEIMGSUITE main EOF log_status $? diff --git a/testing/scripts/build-certs b/testing/scripts/build-certs index a8648033c..04f4fc703 100755 --- a/testing/scripts/build-certs +++ b/testing/scripts/build-certs @@ -22,6 +22,8 @@ mkdir -p $IMGDIR log_action "Connecting root image to NBD device $NBDEV" execute "qemu-nbd -c $NBDEV $ROOTIMG" do_on_exit qemu-nbd -d $NBDEV +# wait for disk to become ready with newer QEMU versions +sleep 1 blockdev --rereadpt $NBDEV log_action "Mounting $NBDPARTITION to $LOOPDIR" diff --git a/testing/scripts/build-guestimages b/testing/scripts/build-guestimages index 5050b3748..c4d87c187 100755 --- a/testing/scripts/build-guestimages +++ b/testing/scripts/build-guestimages @@ -37,14 +37,19 @@ mkdir -p $LOOPDIR # just to be sure do_on_exit qemu-nbd -d $NBDEV do_on_exit umount $LOOPDIR +do_on_exit umount $LOOPDIR/proc for host in $STRONGSWANHOSTS do log_action "Creating guest image for $host" execute "qemu-img create -b $ROOTIMG -f $IMGEXT -F $IMGEXT $IMGDIR/$host.$IMGEXT" 0 execute "qemu-nbd -c $NBDEV $IMGDIR/$host.$IMGEXT" 0 + # wait for disk to become ready with newer QEMU versions + sleep 1 blockdev --rereadpt $NBDEV execute "mount $NBDPARTITION $LOOPDIR" 0 + execute "mount -t proc none $LOOPDIR/proc" 0 + execute "mv $LOOPDIR/usr/local/sbin/ipsec $LOOPDIR/usr/local/sbin/ipsec.orig" 0 execute "cp -rf $HOSTSDIR/default/* $LOOPDIR" 0 execute "cp -rf $HOSTSDIR/${host}/etc $LOOPDIR" 0 execute_chroot "ldconfig" 0 @@ -74,24 +79,14 @@ do execute_chroot "dnssec-signzone -K /etc/bind -o org. /etc/bind/db.org" 0 execute_chroot "dnssec-signzone -K /etc/bind -o . /etc/bind/db.root" 0 - # on bullseye and newer, enabling via bind9 doesn't work, while - # disabling does, so use named here. on the other hand, older releases - # like buster don't have named service files - SERVICES="apache2 slapd" - case "$BASEIMGSUITE" in - buster) - SERVICES="$SERVICES bind9" - ;; - *) - SERVICES="$SERVICES named" - ;; - esac + SERVICES="apache2 slapd named" for service in $SERVICES do execute_chroot "systemctl enable $service" 0 done fi sync + execute "umount -l $LOOPDIR/proc" 0 execute "umount -l $LOOPDIR" 0 execute "qemu-nbd -d $NBDEV" 0 log_status 0 diff --git a/testing/scripts/build-strongswan b/testing/scripts/build-strongswan index 772c92da7..8e6126ad3 100755 --- a/testing/scripts/build-strongswan +++ b/testing/scripts/build-strongswan @@ -115,6 +115,8 @@ case "$GUEST" in esac do_on_exit qemu-nbd -d $NBDEV +# wait for disk to become ready with newer QEMU versions +sleep 1 blockdev --rereadpt $NBDEV log_action "Mounting $NBDPARTITION to $LOOPDIR" @@ -195,7 +197,7 @@ do execute_chroot "make SRCDIR=/root/strongswan BUILDDIR=/root/shared/build-strongswan QUICK_REBUILD=$QUICK_REBUILD -f /root/shared/build-strongswan/$r" else cp $RECPDIR/$r ${LOOPDIR}/root/shared/compile - execute_chroot "make SWANVERSION=$TARBALL -C /root/shared/compile -f $r" + execute_chroot "make SWANVERSION=$TARBALL BASEIMG=$BASEIMGSUITE -C /root/shared/compile -f $r" fi done diff --git a/testing/scripts/chroot b/testing/scripts/chroot index 60a75df7e..c9a9dec7c 100755 --- a/testing/scripts/chroot +++ b/testing/scripts/chroot @@ -42,6 +42,8 @@ root) esac do_on_exit qemu-nbd -d $NBDEV +# wait for disk to become ready with newer QEMU versions +sleep 1 blockdev --rereadpt $NBDEV log_action "Mounting $NBDPARTITION to $LOOPDIR" @@ -68,4 +70,4 @@ echo fi export debian_chroot="$1" -chroot $LOOPDIR /bin/bash -i +chroot $LOOPDIR /bin/bash -l diff --git a/testing/scripts/function.sh b/testing/scripts/function.sh index c162044e5..faf968f9b 100755 --- a/testing/scripts/function.sh +++ b/testing/scripts/function.sh @@ -48,9 +48,23 @@ execute() # execute command in chroot # $1 - command to execute +# $2 - whether or not to log command exit status +# (0 -> disable exit status logging) execute_chroot() { - execute "chroot $LOOPDIR env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin $@" + cmd=${1} + echo chroot $LOOPDIR $cmd >>$LOGFILE 2>&1 + chroot $LOOPDIR /bin/bash -l <<-EOF >>$LOGFILE 2>&1 + $cmd + EOF + status=$? + [ "$2" != 0 ] && log_status $status + if [ $status != 0 ]; then + echo + echo "! Command chroot $LOOPDIR $cmd failed, exiting (status $status)" + echo "! Check why here $LOGFILE" + exit 1 + fi } # write green status message to console diff --git a/testing/scripts/recipes/006_tkm-rpc.mk b/testing/scripts/recipes/006_tkm-rpc.mk index 779ffacd4..3f930dc76 100644 --- a/testing/scripts/recipes/006_tkm-rpc.mk +++ b/testing/scripts/recipes/006_tkm-rpc.mk @@ -2,7 +2,7 @@ PKG = tkm-rpc SRC = https://git.codelabs.ch/git/$(PKG).git -REV = v0.4 +REV = c43c7d2a070d37e4063b83be0dc01425bf890206 PREFIX = /usr/local/ada diff --git a/testing/scripts/recipes/008_xfrm-ada.mk b/testing/scripts/recipes/008_xfrm-ada.mk index 185f813e7..6202d7bb6 100644 --- a/testing/scripts/recipes/008_xfrm-ada.mk +++ b/testing/scripts/recipes/008_xfrm-ada.mk @@ -2,7 +2,7 @@ PKG = xfrm-ada SRC = https://git.codelabs.ch/git/$(PKG).git -REV = v0.1 +REV = e0590c6bb3c6a5b7f2edd8f95dce9e8c77e22230 PREFIX = /usr/local/ada diff --git a/testing/scripts/recipes/010_tkm.mk b/testing/scripts/recipes/010_tkm.mk index 589d96533..d82f6a95c 100644 --- a/testing/scripts/recipes/010_tkm.mk +++ b/testing/scripts/recipes/010_tkm.mk @@ -2,7 +2,11 @@ PKG = tkm SRC = https://git.codelabs.ch/git/$(PKG).git +ifeq (,$(filter $(BASEIMG),bullseye bookworm)) +REV = 85d49c9255360663c344ccf3175092524dc66eae +else REV = v0.3 +endif export ADA_PROJECT_PATH=/usr/local/ada/lib/gnat diff --git a/testing/scripts/recipes/014_swid_generator.mk b/testing/scripts/recipes/014_swid_generator.mk index 9f8407aa3..c10e00d8d 100644 --- a/testing/scripts/recipes/014_swid_generator.mk +++ b/testing/scripts/recipes/014_swid_generator.mk @@ -17,4 +17,8 @@ $(TAR): @touch $@ install: .$(PKG)-unpacked-$(REV) +ifeq (,$(filter $(BASEIMG),bullseye bookworm)) + cd $(DIR) && pipx install --global --system-site-packages . +else cd $(DIR) && SETUPTOOLS_USE_DISTUTILS=stdlib python3 setup.py install +endif diff --git a/testing/scripts/recipes/015_strongTNC.mk b/testing/scripts/recipes/015_strongTNC.mk index 673b4b09e..f95d8a72e 100644 --- a/testing/scripts/recipes/015_strongTNC.mk +++ b/testing/scripts/recipes/015_strongTNC.mk @@ -1,13 +1,15 @@ #!/usr/bin/make PKG = strongTNC -REV = 1.0.2 +REV = f0ed6fa8ef6bcde56283c6da1bdbdaa3d651eb11 DIR = $(PKG)-$(REV) ZIP = $(PKG)-$(REV).zip SRC = https://github.com/strongswan/$(PKG)/archive/$(REV).zip DEPS = $(PKG)-deps VENV = /usr/local/venvs/tnc +EXTRAS = setuptools legacy-cgi + all: install $(ZIP): @@ -19,10 +21,10 @@ $(ZIP): .$(PKG)-deps-$(REV): .$(PKG)-unpacked-$(REV) python3 -m venv $(VENV) - $(VENV)/bin/pip download -d $(DEPS) -r $(DIR)/requirements.txt + $(VENV)/bin/pip download -d $(DEPS) -r $(DIR)/requirements.txt $(EXTRAS) @touch $@ install: .$(PKG)-deps-$(REV) python3 -m venv $(VENV) - $(VENV)/bin/pip install --no-index --find-links=file://`pwd`/$(DEPS) -r $(DIR)/requirements.txt + $(VENV)/bin/pip install --no-index --find-links=file://`pwd`/$(DEPS) -r $(DIR)/requirements.txt $(EXTRAS) cp -r $(DIR) /var/www/tnc && chgrp -R www-data /var/www/tnc && chmod g+sw /var/www/tnc diff --git a/testing/ssh_config b/testing/ssh_config index 3ecdd27d1..0974b990b 100644 --- a/testing/ssh_config +++ b/testing/ssh_config @@ -2,7 +2,7 @@ Host * LogLevel QUIET # debian default SendEnv LANG LC_* - SendEnv LEAK_DETECTIVE_LOG + SendEnv LEAK_DETECTIVE_* StrictHostKeyChecking no UserKnownHostsFile /dev/null GSSAPIAuthentication yes diff --git a/testing/testing.conf b/testing/testing.conf index f02b44ac1..74e81a336 100644 --- a/testing/testing.conf +++ b/testing/testing.conf @@ -49,7 +49,7 @@ fi # Base image settings # The base image is a pristine OS installation created using debootstrap. : ${BASEIMGSIZE=2500} -: ${BASEIMGSUITE=bookworm} +: ${BASEIMGSUITE=trixie} : ${BASEIMGARCH=amd64} : ${BASEIMG=$IMGDIR/debian-$BASEIMGSUITE-$BASEIMGARCH.$IMGEXT} : ${BASEIMGMIRROR=http://http.debian.net/debian} diff --git a/testing/tkm/Dockerfile b/testing/tkm/Dockerfile index d7dcc76fb..f97d2c377 100644 --- a/testing/tkm/Dockerfile +++ b/testing/tkm/Dockerfile @@ -23,12 +23,12 @@ # # make -j check TESTS_RUNNERS=tkm TESTS_TKM=1 -FROM debian:bookworm +FROM debian:trixie ARG packages="autoconf automake bison build-essential ca-certificates ccache \ flex git gperf libssl-dev libtool pkg-config \ -gnat gprbuild libahven11-dev libxmlada-schema12-dev libgmpada12-dev \ -libalog8-dev" +gnat gprbuild libahven-dev libxmlada-schema-dev libgmpada-dev \ +libalog-dev" RUN apt-get update && \ DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \ @@ -48,8 +48,8 @@ RUN cd /tmp/recipes \ && make -f 010_tkm.mk \ && rm -rf /tmp/recipes -ENV ADA_PROJECT_PATH /usr/local/ada/lib/gnat -ENV PATH /usr/lib/ccache:$PATH +ENV ADA_PROJECT_PATH=/usr/local/ada/lib/gnat +ENV PATH=/usr/lib/ccache:$PATH COPY tkm/generate-config.sh /usr/local/share/tkm/ COPY tests/tkm/host2host-initiator/hosts/moon/etc/tkm/tkm.conf /usr/local/share/tkm/