testing: Ignore IP-in-IP SAs created with IPComp SAs that remain in the kernel

The kernel creates such SAs to handle uncompressed small packets.  They
are implicitly created and deleted with IPComp SAs.  The problem is that
when we delete an IPComp SA only that state is deleted and removed from
the SA lists immediately, the IP-in-IP state is not removed until the IPComp
state is eventually destroyed.  This could take a while if there are still
references to it around.  So the IP-in-IP states will keep getting reported
by ip xfrm state until that happens (we also can't flush or explicitly delete
such kernel-created states).

In kernels before 4.14 this wasn't really a problem but since
ec30d78c14a8 ("xfrm: add xdst pcpu cache") the kernel seems to keep the
references to the last used SAs around a lot longer.

Also, usually a test scenario following an IPComp scenario will create
and use new SAs and thus the cached SAs will disappear before the kernel
state is checked again.  However, if a following scenario uses different
hosts the states might remain, which caused some unrelated scenarios to
fail before adding this fix.

diff --git a/testing/do-tests b/testing/do-tests
index 38999ea615aa9116d8afc761c990bb0fad05d7f3..641529533384a060c77964e4c60d02d51fbeaa73 100755 (executable)
--- a/testing/do-tests
+++ b/testing/do-tests
@@ -776,8 +776,10 @@ do
        do
                eval HOSTLOGIN=root@\$ipv4_${host}
                IPSECSTATE=`ssh $SSHCONF $HOSTLOGIN 'ip xfrm state'`
+               # ignore IPv4/v6 states created with IPComp SAs
+               IPSECSTATEISSUE=`echo "$IPSECSTATE" | grep 'proto.*spi' | grep -v 'proto 4'`
                IPSECPOLICY=`ssh $SSHCONF $HOSTLOGIN 'ip xfrm policy'`
-               if [ -n "$IPSECSTATE" -o -n "$IPSECPOLICY" ]
+               if [ -n "$IPSECSTATEISSUE" -o -n "$IPSECPOLICY" ]
                then
                        echo -e "\n$host# ip xfrm state [NO]" >> $CONSOLE_LOG
                        echo "$IPSECSTATE" >> $CONSOLE_LOG