From 394d709d2e2c4bfa38acb19596e1670e6cf27f74 Mon Sep 17 00:00:00 2001 From: Robur Team Date: Wed, 26 Jun 2024 14:02:41 +0000 Subject: [PATCH] Built from 0f79f4c7c9f39e2fb71042b6f225632d4403ce4a --- articles/miragevpn-testing.html | 68 +++++++++++++++++++++++++++++++++ feed.xml | 2 +- index.html | 13 +++++++ tags/community.html | 2 +- tags/cryptography.html | 6 +-- tags/git.html | 2 +- tags/gpt.html | 2 +- tags/mbr.html | 2 +- tags/mirageos.html | 6 +-- tags/ocaml.html | 6 +-- tags/performance.html | 2 +- tags/persistent storage.html | 2 +- tags/python.html | 2 +- tags/qubesos.html | 2 +- tags/scheduler.html | 2 +- tags/security.html | 6 +-- tags/tar.html | 2 +- tags/testing.html | 41 ++++++++++++++++++++ tags/unicode.html | 2 +- tags/unikernel.html | 2 +- tags/vpn.html | 6 +-- 21 files changed, 150 insertions(+), 28 deletions(-) create mode 100644 articles/miragevpn-testing.html create mode 100644 tags/testing.html diff --git a/articles/miragevpn-testing.html b/articles/miragevpn-testing.html new file mode 100644 index 0000000..04514a5 --- /dev/null +++ b/articles/miragevpn-testing.html @@ -0,0 +1,68 @@ + + + + + + + + + Robur's blog - Testing MirageVPN against OpenVPN™ + + + + + + + + +
+

blog.robur.coop

+
+ The Robur cooperative blog. +
+
+
Back to index + +
+

Testing MirageVPN against OpenVPN™

+

As our last milestone for the EU NGI Assure funded MirageVPN project (for now) we have been working on testing MirageVPN, our OpenVPN™-compatible VPN implementation against the upstream OpenVPN™. +During the development we have conducted many manual tests. +However, this scales poorly and it is easy to forget testing certain cases. +Therefore, we designed and implemented interoperability testing, driving the C implementation on the one side, and our OCaml implementation on the other side. The input for such a test is a configuration file that both implementations can use. +Thus we test establishment of the tunnel as well as the tunnel itself.

+

While conducting the tests, our instrumented binaries expose code coverage information. We use that to guide ourselves which other configurations are worth testing. Our goal is to achieve a high code coverage rate while using a small amount of different configurations. These interoperability tests are running fast enough, so they are executed on each commit by CI.

+

A nice property of this test setup is that it runs with an unmodified OpenVPN binary. +This means we can use an off-the-shelf OpenVPN binary from the package repository and does not entail further maintenance of an OpenVPN fork. +Testing against a future version of OpenVPN becomes trivial. +We do not just test a single part of our implementation but achieve an end-to-end test. +The same configuration files are used for both our implementation and the C implementation, and each configuration is used twice, once our implementation acts as the client, once as the server.

+

We added a flag to our client and our recently finished server applications, --test, which make them to exit once a tunnel is established and an ICMP echo request from the client has been replied to by the server. +Our client and server can be run without a tun device which otherwise would require elevated privileges. +Unfortunately, OpenVPN requires privileges to at least configure a tun device. +Our MirageVPN implementation does IP packet parsing in userspace. +We test our protocol implementation, not the entire unikernel - but the unikernel code is a tiny layer on top of the purely functional protocol implementation.

+

We explored unit testing the packet decoding and decryption with our implementation and the C implementation. +Specifically, we encountered a packet whose message authentication code (MAC) was deemed invalid by the C implementation. +It helped us discover the MAC computation was correct but the packet encoding was truncated - both implementations agreed that the MAC was bad. +The test was very tedious to write and would not easily scale to cover a large portion of the code. +If of interest, take a look into our modifications to OpenVPN and modifications to MirageVPN.

+

The end-to-end testing is in addition to our unit tests and fuzz testing; and to our benchmarking binary.

+

Our results are that with 4 configurations we achieve above 75% code coverage in MirageVPN. +While investigating the code coverage results, we found various pieces of code that were never executed, and we were able to remove them. +Code that does not exist is bug-free :D +With these tests in place future maintenance is less daunting as they will help us guard us from breaking the code.

+

At the moment we do not exercise the error paths very well in the code. +This is much less straightforward to test in this manner, and is important future work. +We plan to develop a client and server that injects faults at various stages of the protocol to test these error paths. +OpenVPN built with debugging enabled also comes with a --gremlin mode that injects faults, and would be interesting to investigate.

+ +
+ +
+ + + + diff --git a/feed.xml b/feed.xml index 755b860..ebc72e4 100644 --- a/feed.xml +++ b/feed.xml @@ -1 +1 @@ -Robur's bloghttps://blog.robur.coopThe Robur cooperative blogyocamlteam@robur.coopqubes-miragevpn, a MirageVPN client for QubesOShttps://blog.robur.coop/articles/qubes-miragevpn.htmlMon, 24 Jun 2024 10:00:00 GMTA new OpenVPN client for QubesOShttps://blog.robur.coop/articles/qubes-miragevpn.htmlMirageVPN serverhttps://blog.robur.coop/articles/miragevpn-server.htmlMon, 17 Jun 2024 10:00:00 GMTAnnouncement of our MirageVPN server.https://blog.robur.coop/articles/miragevpn-server.htmlSpeeding up MirageVPN and use it in the wildhttps://blog.robur.coop/articles/miragevpn-performance.htmlTue, 16 Apr 2024 10:00:00 GMTPerformance engineering of MirageVPN, speeding it up by a factor of 25.https://blog.robur.coop/articles/miragevpn-performance.htmlGPTarhttps://blog.robur.coop/articles/gptar.htmlWed, 21 Feb 2024 10:00:00 GMTHybrid GUID partition table and tar archivehttps://blog.robur.coop/articles/gptar.htmlSpeeding elliptic curve cryptographyhttps://blog.robur.coop/articles/speeding-ec-string.htmlTue, 13 Feb 2024 10:00:00 GMTHow we improved the performance of elliptic curves by only modifying the underlying byte arrayhttps://blog.robur.coop/articles/speeding-ec-string.htmlCooperation and Lwt.pausehttps://blog.robur.coop/articles/lwt_pause.htmlSun, 11 Feb 2024 10:00:00 GMTA disgression about Lwt and Miouhttps://blog.robur.coop/articles/lwt_pause.htmlPython's `str.__repr__()`https://blog.robur.coop/articles/2024-02-03-python-str-repr.htmlSat, 03 Feb 2024 10:00:00 GMTReimplementing Python string escaping in OCamlhttps://blog.robur.coop/articles/2024-02-03-python-str-repr.htmlMirageVPN updated (AEAD, NCP)https://blog.robur.coop/articles/miragevpn-ncp.htmlMon, 20 Nov 2023 10:00:00 GMTHow we resurrected MirageVPN from its bitrot statehttps://blog.robur.coop/articles/miragevpn-ncp.htmlMirageVPN & tls-crypt-v2https://blog.robur.coop/articles/miragevpn.htmlTue, 14 Nov 2023 10:00:00 GMTHow we implementated tls-crypt-v2 for miragevpnhttps://blog.robur.coop/articles/miragevpn.html \ No newline at end of file +Robur's bloghttps://blog.robur.coopThe Robur cooperative blogyocamlteam@robur.coopTesting MirageVPN against OpenVPN™https://blog.robur.coop/articles/miragevpn-testing.htmlWed, 26 Jun 2024 10:00:00 GMTSome notes about how we test MirageVPN against OpenVPN™https://blog.robur.coop/articles/miragevpn-testing.htmlqubes-miragevpn, a MirageVPN client for QubesOShttps://blog.robur.coop/articles/qubes-miragevpn.htmlMon, 24 Jun 2024 10:00:00 GMTA new OpenVPN client for QubesOShttps://blog.robur.coop/articles/qubes-miragevpn.htmlMirageVPN serverhttps://blog.robur.coop/articles/miragevpn-server.htmlMon, 17 Jun 2024 10:00:00 GMTAnnouncement of our MirageVPN server.https://blog.robur.coop/articles/miragevpn-server.htmlSpeeding up MirageVPN and use it in the wildhttps://blog.robur.coop/articles/miragevpn-performance.htmlTue, 16 Apr 2024 10:00:00 GMTPerformance engineering of MirageVPN, speeding it up by a factor of 25.https://blog.robur.coop/articles/miragevpn-performance.htmlGPTarhttps://blog.robur.coop/articles/gptar.htmlWed, 21 Feb 2024 10:00:00 GMTHybrid GUID partition table and tar archivehttps://blog.robur.coop/articles/gptar.htmlSpeeding elliptic curve cryptographyhttps://blog.robur.coop/articles/speeding-ec-string.htmlTue, 13 Feb 2024 10:00:00 GMTHow we improved the performance of elliptic curves by only modifying the underlying byte arrayhttps://blog.robur.coop/articles/speeding-ec-string.htmlCooperation and Lwt.pausehttps://blog.robur.coop/articles/lwt_pause.htmlSun, 11 Feb 2024 10:00:00 GMTA disgression about Lwt and Miouhttps://blog.robur.coop/articles/lwt_pause.htmlPython's `str.__repr__()`https://blog.robur.coop/articles/2024-02-03-python-str-repr.htmlSat, 03 Feb 2024 10:00:00 GMTReimplementing Python string escaping in OCamlhttps://blog.robur.coop/articles/2024-02-03-python-str-repr.htmlMirageVPN updated (AEAD, NCP)https://blog.robur.coop/articles/miragevpn-ncp.htmlMon, 20 Nov 2023 10:00:00 GMTHow we resurrected MirageVPN from its bitrot statehttps://blog.robur.coop/articles/miragevpn-ncp.htmlMirageVPN & tls-crypt-v2https://blog.robur.coop/articles/miragevpn.htmlTue, 14 Nov 2023 10:00:00 GMTHow we implementated tls-crypt-v2 for miragevpnhttps://blog.robur.coop/articles/miragevpn.html \ No newline at end of file diff --git a/index.html b/index.html index 91209a7..84ebb6f 100644 --- a/index.html +++ b/index.html @@ -26,6 +26,19 @@

Essays and ramblings

  1. +
    + + +
    +
    + 2024-06-26 + Testing MirageVPN against OpenVPN™
    +

    Some notes about how we test MirageVPN against OpenVPN™

    +
    + +
    +
    +
  2. diff --git a/tags/community.html b/tags/community.html index 23a6994..e0a0d9e 100644 --- a/tags/community.html +++ b/tags/community.html @@ -23,7 +23,7 @@
    Back to index - +
    diff --git a/tags/git.html b/tags/git.html index fe5f870..d8c9a84 100644 --- a/tags/git.html +++ b/tags/git.html @@ -23,7 +23,7 @@
    Back to index - +

    git diff --git a/tags/gpt.html b/tags/gpt.html index 5d05cfe..d313322 100644 --- a/tags/gpt.html +++ b/tags/gpt.html @@ -23,7 +23,7 @@
    Back to index - +

    gpt diff --git a/tags/mbr.html b/tags/mbr.html index 1c28b3c..4fa8d4f 100644 --- a/tags/mbr.html +++ b/tags/mbr.html @@ -23,7 +23,7 @@
    Back to index - +
    diff --git a/tags/ocaml.html b/tags/ocaml.html index 09f25ea..0e0d390 100644 --- a/tags/ocaml.html +++ b/tags/ocaml.html @@ -23,12 +23,12 @@
    Back to index - +

    +
    diff --git a/tags/performance.html b/tags/performance.html index 8fb3aad..5901981 100644 --- a/tags/performance.html +++ b/tags/performance.html @@ -23,7 +23,7 @@
    Back to index - +

    performance diff --git a/tags/persistent storage.html b/tags/persistent storage.html index 728674d..b134e69 100644 --- a/tags/persistent storage.html +++ b/tags/persistent storage.html @@ -23,7 +23,7 @@
    Back to index - +

    persistent storage diff --git a/tags/python.html b/tags/python.html index db861e4..356e3d6 100644 --- a/tags/python.html +++ b/tags/python.html @@ -23,7 +23,7 @@
    Back to index - +

    python diff --git a/tags/qubesos.html b/tags/qubesos.html index 3cc1696..1975235 100644 --- a/tags/qubesos.html +++ b/tags/qubesos.html @@ -23,7 +23,7 @@
    Back to index - +

    qubesos diff --git a/tags/scheduler.html b/tags/scheduler.html index 20774fd..93eb061 100644 --- a/tags/scheduler.html +++ b/tags/scheduler.html @@ -23,7 +23,7 @@
    Back to index - +
    diff --git a/tags/tar.html b/tags/tar.html index e5752b4..d2c68fb 100644 --- a/tags/tar.html +++ b/tags/tar.html @@ -23,7 +23,7 @@
    Back to index - +

    tar diff --git a/tags/testing.html b/tags/testing.html new file mode 100644 index 0000000..84a41bd --- /dev/null +++ b/tags/testing.html @@ -0,0 +1,41 @@ + + + + + + + + + Robur's blog + + + + + + + + +
    +

    blog.robur.coop

    +
    + The Robur cooperative blog. +
    +
    +
    Back to index + + + +

    + testing + 1 entry

    + +
    + +
    + + + + diff --git a/tags/unicode.html b/tags/unicode.html index 0504f7e..3ef777f 100644 --- a/tags/unicode.html +++ b/tags/unicode.html @@ -23,7 +23,7 @@
    Back to index - +

    unicode diff --git a/tags/unikernel.html b/tags/unikernel.html index 2d692d5..8e9c1ba 100644 --- a/tags/unikernel.html +++ b/tags/unikernel.html @@ -23,7 +23,7 @@
    Back to index - +