Pushed by YOCaml 2 from 7f47c4032f5ab40e0876a5259b296c230cb898ad
This commit is contained in:
The Robur Team
parent
73a2d52b45
commit
093d8fd0cd
4 changed files with 98 additions and 6 deletions
67
articles/miragevpn-testing.html
Normal file
67
articles/miragevpn-testing.html
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="x-ua-compatible" content="ie=edge">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>
|
||||
Robur's blogTesting MirageVPN against OpenVPN™
|
||||
</title>
|
||||
<meta name="description" content="Some notes about how we test MirageVPN against OpenVPN™">
|
||||
<link type="text/css" rel="stylesheet" href="/css/hl.css">
|
||||
<link type="text/css" rel="stylesheet" href="/css/style.css">
|
||||
<script src="/js/hl.js"></script>
|
||||
<link rel="alternate" type="application/rss+xml" href="/feed.xml" title="blog.robur.coop">
|
||||
</head>
|
||||
<body>
|
||||
<header>
|
||||
<h1>blog.robur.coop</h1>
|
||||
<blockquote>
|
||||
The <strong>Robur</strong> cooperative blog.
|
||||
</blockquote>
|
||||
</header>
|
||||
<main><a href="/index.html">Back to index</a>
|
||||
|
||||
<article>
|
||||
<h1>Testing MirageVPN against OpenVPN™</h1>
|
||||
<ul class="tags-list"><li><a href="/tags.html#tag-OCaml">OCaml</a></li><li><a href="/tags.html#tag-MirageOS">MirageOS</a></li><li><a href="/tags.html#tag-cryptography">cryptography</a></li><li><a href="/tags.html#tag-security">security</a></li><li><a href="/tags.html#tag-testing">testing</a></li><li><a href="/tags.html#tag-vpn">vpn</a></li></ul><p>As our last milestone for the <a href="https://www.assure.ngi.eu/">EU NGI Assure</a> funded MirageVPN project (for now) we have been working on testing MirageVPN, our OpenVPN™-compatible VPN implementation against the upstream OpenVPN™.
|
||||
During the development we have conducted many manual tests.
|
||||
However, this scales poorly and it is easy to forget testing certain cases.
|
||||
Therefore, we designed and implemented interoperability testing, driving the C implementation on the one side, and our OCaml implementation on the other side. The input for such a test is a configuration file that both implementations can use.
|
||||
Thus we test establishment of the tunnel as well as the tunnel itself.</p>
|
||||
<p>While conducting the tests, our instrumented binaries expose code coverage information. We use that to guide ourselves which other configurations are worth testing. Our goal is to achieve a high code coverage rate while using a small amount of different configurations. These interoperability tests are running fast enough, so they are executed on each commit by CI.</p>
|
||||
<p>A nice property of this test setup is that it runs with an unmodified OpenVPN binary.
|
||||
This means we can use an off-the-shelf OpenVPN binary from the package repository and does not entail further maintenance of an OpenVPN fork.
|
||||
Testing against a future version of OpenVPN becomes trivial.
|
||||
We do not just test a single part of our implementation but achieve an end-to-end test.
|
||||
The same configuration files are used for both our implementation and the C implementation, and each configuration is used twice, once our implementation acts as the client, once as the server.</p>
|
||||
<p>We added a flag to our client and our <a href="miragevpn-server">recently finished server</a> applications, <code>--test</code>, which make them to exit once a tunnel is established and an ICMP echo request from the client has been replied to by the server.
|
||||
Our client and server can be run without a tun device which otherwise would require elevated privileges.
|
||||
Unfortunately, OpenVPN requires privileges to at least configure a tun device.
|
||||
Our MirageVPN implementation does IP packet parsing in userspace.
|
||||
We test our protocol implementation, not the entire unikernel - but the unikernel code is a tiny layer on top of the purely functional protocol implementation.</p>
|
||||
<p>We explored unit testing the packet decoding and decryption with our implementation and the C implementation.
|
||||
Specifically, we encountered a packet whose message authentication code (MAC) was deemed invalid by the C implementation.
|
||||
It helped us discover the MAC computation was correct but the packet encoding was truncated - both implementations agreed that the MAC was bad.
|
||||
The test was very tedious to write and would not easily scale to cover a large portion of the code.
|
||||
If of interest, take a look into our <a href="https://github.com/reynir/openvpn/tree/badmac-test">modifications to OpenVPN</a> and <a href="https://github.com/robur-coop/miragevpn/tree/badmac-test">modifications to MirageVPN</a>.</p>
|
||||
<p>The end-to-end testing is in addition to our unit tests and fuzz testing; and to our <a href="miragevpn-performance">benchmarking</a> binary.</p>
|
||||
<p>Our results are that with 4 configurations we achieve above 75% code coverage in MirageVPN.
|
||||
While investigating the code coverage results, we found various pieces of code that were never executed, and we were able to remove them.
|
||||
Code that does not exist is bug-free :D
|
||||
With these tests in place future maintenance is less daunting as they will help us guard us from breaking the code.</p>
|
||||
<p>At the moment we do not exercise the error paths very well in the code.
|
||||
This is much less straightforward to test in this manner, and is important future work.
|
||||
We plan to develop a client and server that injects faults at various stages of the protocol to test these error paths.
|
||||
OpenVPN built with debugging enabled also comes with a <code>--gremlin</code> mode that injects faults, and would be interesting to investigate.</p>
|
||||
|
||||
</article>
|
||||
|
||||
</main>
|
||||
<footer>
|
||||
<a href="https://github.com/xhtmlboi/yocaml">Powered by <strong>YOCaml</strong></a>
|
||||
<br />
|
||||
</footer>
|
||||
<script>hljs.highlightAll();</script>
|
||||
</body>
|
||||
</html>
|
||||
7
feed.xml
7
feed.xml
|
|
@ -47,6 +47,13 @@
|
|||
<guid isPermaLink="true">https://blog.robur.coop/articles/tar-release.html</guid>
|
||||
<pubDate>Thu, 15 Aug 2024 00:00:00 GMT</pubDate>
|
||||
</item>
|
||||
<item>
|
||||
<title>Testing MirageVPN against OpenVPN™</title>
|
||||
<link>https://blog.robur.coop/articles/miragevpn-testing.html</link>
|
||||
<description><![CDATA[Some notes about how we test MirageVPN against OpenVPN™]]></description>
|
||||
<guid isPermaLink="true">https://blog.robur.coop/articles/miragevpn-testing.html</guid>
|
||||
<pubDate>Wed, 26 Jun 2024 00:00:00 GMT</pubDate>
|
||||
</item>
|
||||
<item>
|
||||
<title>qubes-miragevpn, a MirageVPN client for QubesOS</title>
|
||||
<link>https://blog.robur.coop/articles/qubes-miragevpn.html</link>
|
||||
|
|
|
|||
13
index.html
13
index.html
|
|
@ -89,6 +89,19 @@
|
|||
<ul class="tags-list"><li><a href="/tags.html#tag-OCaml">OCaml</a></li><li><a href="/tags.html#tag-Cstruct">Cstruct</a></li><li><a href="/tags.html#tag-functors">functors</a></li></ul>
|
||||
</div>
|
||||
</div>
|
||||
</li><li>
|
||||
<div class="side">
|
||||
<a href="https://reyn.ir/">
|
||||
<img src="https://www.gravatar.com/avatar/54a15736b37879bc9708c1618a7cc130">
|
||||
</a></div>
|
||||
<div class="content">
|
||||
<span class="date">2024-06-26</span>
|
||||
<a href="/articles/miragevpn-testing.html">Testing MirageVPN against OpenVPN™</a><br />
|
||||
<p>Some notes about how we test MirageVPN against OpenVPN™</p>
|
||||
<div class="bottom">
|
||||
<ul class="tags-list"><li><a href="/tags.html#tag-OCaml">OCaml</a></li><li><a href="/tags.html#tag-MirageOS">MirageOS</a></li><li><a href="/tags.html#tag-cryptography">cryptography</a></li><li><a href="/tags.html#tag-security">security</a></li><li><a href="/tags.html#tag-testing">testing</a></li><li><a href="/tags.html#tag-vpn">vpn</a></li></ul>
|
||||
</div>
|
||||
</div>
|
||||
</li><li>
|
||||
<div class="side">
|
||||
<a href="https://blog.osau.re/">
|
||||
|
|
|
|||
17
tags.html
17
tags.html
|
|
@ -22,7 +22,7 @@
|
|||
</header>
|
||||
<main><a href="/index.html">Back to index</a>
|
||||
|
||||
<ul class="tags-list aeration"><li><a href="#tag-Community">Community</a></li><li><a href="#tag-Cstruct">Cstruct</a></li><li><a href="#tag-DNSvizor">DNSvizor</a></li><li><a href="#tag-Git">Git</a></li><li><a href="#tag-MirageOS">MirageOS</a></li><li><a href="#tag-MirageVPN">MirageVPN</a></li><li><a href="#tag-OCaml">OCaml</a></li><li><a href="#tag-OpenVPN">OpenVPN</a></li><li><a href="#tag-Python">Python</a></li><li><a href="#tag-QubesOS">QubesOS</a></li><li><a href="#tag-Scheduler">Scheduler</a></li><li><a href="#tag-Unikernel">Unikernel</a></li><li><a href="#tag-VPN">VPN</a></li><li><a href="#tag-cooperative">cooperative</a></li><li><a href="#tag-cryptography">cryptography</a></li><li><a href="#tag-finances">finances</a></li><li><a href="#tag-functors">functors</a></li><li><a href="#tag-gpt">gpt</a></li><li><a href="#tag-mbr">mbr</a></li><li><a href="#tag-performance">performance</a></li><li><a href="#tag-persistent storage">persistent storage</a></li><li><a href="#tag-security">security</a></li><li><a href="#tag-tar">tar</a></li><li><a href="#tag-unicode">unicode</a></li><li><a href="#tag-unikernel">unikernel</a></li><li><a href="#tag-vpn">vpn</a></li></ul><div class="tag-box" id="tag-Community">
|
||||
<ul class="tags-list aeration"><li><a href="#tag-Community">Community</a></li><li><a href="#tag-Cstruct">Cstruct</a></li><li><a href="#tag-DNSvizor">DNSvizor</a></li><li><a href="#tag-Git">Git</a></li><li><a href="#tag-MirageOS">MirageOS</a></li><li><a href="#tag-MirageVPN">MirageVPN</a></li><li><a href="#tag-OCaml">OCaml</a></li><li><a href="#tag-OpenVPN">OpenVPN</a></li><li><a href="#tag-Python">Python</a></li><li><a href="#tag-QubesOS">QubesOS</a></li><li><a href="#tag-Scheduler">Scheduler</a></li><li><a href="#tag-Unikernel">Unikernel</a></li><li><a href="#tag-VPN">VPN</a></li><li><a href="#tag-cooperative">cooperative</a></li><li><a href="#tag-cryptography">cryptography</a></li><li><a href="#tag-finances">finances</a></li><li><a href="#tag-functors">functors</a></li><li><a href="#tag-gpt">gpt</a></li><li><a href="#tag-mbr">mbr</a></li><li><a href="#tag-performance">performance</a></li><li><a href="#tag-persistent storage">persistent storage</a></li><li><a href="#tag-security">security</a></li><li><a href="#tag-tar">tar</a></li><li><a href="#tag-testing">testing</a></li><li><a href="#tag-unicode">unicode</a></li><li><a href="#tag-unikernel">unikernel</a></li><li><a href="#tag-vpn">vpn</a></li></ul><div class="tag-box" id="tag-Community">
|
||||
<h3>
|
||||
<span>Community</span>
|
||||
</h3>
|
||||
|
|
@ -46,7 +46,7 @@
|
|||
<h3>
|
||||
<span>MirageOS</span>
|
||||
</h3>
|
||||
<ul><li><a href="/articles/miragevpn.html">MirageVPN & tls-crypt-v2</a></li><li><a href="/articles/miragevpn-ncp.html">MirageVPN updated (AEAD, NCP)</a></li><li><a href="/articles/speeding-ec-string.html">Speeding elliptic curve cryptography</a></li><li><a href="/articles/miragevpn-performance.html">Speeding up MirageVPN and use it in the wild</a></li><li><a href="/articles/miragevpn-server.html">MirageVPN server</a></li><li><a href="/articles/arguments.html">Runtime arguments in MirageOS</a></li><li><a href="/articles/dnsvizor01.html">Meet DNSvizor: run your own DHCP and DNS MirageOS unikernel</a></li></ul>
|
||||
<ul><li><a href="/articles/miragevpn.html">MirageVPN & tls-crypt-v2</a></li><li><a href="/articles/miragevpn-ncp.html">MirageVPN updated (AEAD, NCP)</a></li><li><a href="/articles/speeding-ec-string.html">Speeding elliptic curve cryptography</a></li><li><a href="/articles/miragevpn-performance.html">Speeding up MirageVPN and use it in the wild</a></li><li><a href="/articles/miragevpn-server.html">MirageVPN server</a></li><li><a href="/articles/miragevpn-testing.html">Testing MirageVPN against OpenVPN™</a></li><li><a href="/articles/arguments.html">Runtime arguments in MirageOS</a></li><li><a href="/articles/dnsvizor01.html">Meet DNSvizor: run your own DHCP and DNS MirageOS unikernel</a></li></ul>
|
||||
</div><div class="tag-box" id="tag-MirageVPN">
|
||||
<h3>
|
||||
<span>MirageVPN</span>
|
||||
|
|
@ -56,7 +56,7 @@
|
|||
<h3>
|
||||
<span>OCaml</span>
|
||||
</h3>
|
||||
<ul><li><a href="/articles/miragevpn.html">MirageVPN & tls-crypt-v2</a></li><li><a href="/articles/miragevpn-ncp.html">MirageVPN updated (AEAD, NCP)</a></li><li><a href="/articles/2024-02-03-python-str-repr.html">Python's `str.__repr__()`</a></li><li><a href="/articles/lwt_pause.html">Cooperation and Lwt.pause</a></li><li><a href="/articles/speeding-ec-string.html">Speeding elliptic curve cryptography</a></li><li><a href="/articles/gptar.html">GPTar</a></li><li><a href="/articles/miragevpn-performance.html">Speeding up MirageVPN and use it in the wild</a></li><li><a href="/articles/miragevpn-server.html">MirageVPN server</a></li><li><a href="/articles/qubes-miragevpn.html">qubes-miragevpn, a MirageVPN client for QubesOS</a></li><li><a href="/articles/tar-release.html">The new Tar release, a retrospective</a></li><li><a href="/articles/arguments.html">Runtime arguments in MirageOS</a></li><li><a href="/articles/dnsvizor01.html">Meet DNSvizor: run your own DHCP and DNS MirageOS unikernel</a></li></ul>
|
||||
<ul><li><a href="/articles/miragevpn.html">MirageVPN & tls-crypt-v2</a></li><li><a href="/articles/miragevpn-ncp.html">MirageVPN updated (AEAD, NCP)</a></li><li><a href="/articles/2024-02-03-python-str-repr.html">Python's `str.__repr__()`</a></li><li><a href="/articles/lwt_pause.html">Cooperation and Lwt.pause</a></li><li><a href="/articles/speeding-ec-string.html">Speeding elliptic curve cryptography</a></li><li><a href="/articles/gptar.html">GPTar</a></li><li><a href="/articles/miragevpn-performance.html">Speeding up MirageVPN and use it in the wild</a></li><li><a href="/articles/miragevpn-server.html">MirageVPN server</a></li><li><a href="/articles/qubes-miragevpn.html">qubes-miragevpn, a MirageVPN client for QubesOS</a></li><li><a href="/articles/miragevpn-testing.html">Testing MirageVPN against OpenVPN™</a></li><li><a href="/articles/tar-release.html">The new Tar release, a retrospective</a></li><li><a href="/articles/arguments.html">Runtime arguments in MirageOS</a></li><li><a href="/articles/dnsvizor01.html">Meet DNSvizor: run your own DHCP and DNS MirageOS unikernel</a></li></ul>
|
||||
</div><div class="tag-box" id="tag-OpenVPN">
|
||||
<h3>
|
||||
<span>OpenVPN</span>
|
||||
|
|
@ -96,7 +96,7 @@
|
|||
<h3>
|
||||
<span>cryptography</span>
|
||||
</h3>
|
||||
<ul><li><a href="/articles/speeding-ec-string.html">Speeding elliptic curve cryptography</a></li><li><a href="/articles/miragevpn-performance.html">Speeding up MirageVPN and use it in the wild</a></li><li><a href="/articles/miragevpn-server.html">MirageVPN server</a></li></ul>
|
||||
<ul><li><a href="/articles/speeding-ec-string.html">Speeding elliptic curve cryptography</a></li><li><a href="/articles/miragevpn-performance.html">Speeding up MirageVPN and use it in the wild</a></li><li><a href="/articles/miragevpn-server.html">MirageVPN server</a></li><li><a href="/articles/miragevpn-testing.html">Testing MirageVPN against OpenVPN™</a></li></ul>
|
||||
</div><div class="tag-box" id="tag-finances">
|
||||
<h3>
|
||||
<span>finances</span>
|
||||
|
|
@ -131,12 +131,17 @@
|
|||
<h3>
|
||||
<span>security</span>
|
||||
</h3>
|
||||
<ul><li><a href="/articles/miragevpn.html">MirageVPN & tls-crypt-v2</a></li><li><a href="/articles/miragevpn-ncp.html">MirageVPN updated (AEAD, NCP)</a></li><li><a href="/articles/speeding-ec-string.html">Speeding elliptic curve cryptography</a></li><li><a href="/articles/miragevpn-performance.html">Speeding up MirageVPN and use it in the wild</a></li><li><a href="/articles/miragevpn-server.html">MirageVPN server</a></li><li><a href="/articles/2024-08-21-OpenVPN-and-MirageVPN.html">MirageVPN and OpenVPN</a></li></ul>
|
||||
<ul><li><a href="/articles/miragevpn.html">MirageVPN & tls-crypt-v2</a></li><li><a href="/articles/miragevpn-ncp.html">MirageVPN updated (AEAD, NCP)</a></li><li><a href="/articles/speeding-ec-string.html">Speeding elliptic curve cryptography</a></li><li><a href="/articles/miragevpn-performance.html">Speeding up MirageVPN and use it in the wild</a></li><li><a href="/articles/miragevpn-server.html">MirageVPN server</a></li><li><a href="/articles/miragevpn-testing.html">Testing MirageVPN against OpenVPN™</a></li><li><a href="/articles/2024-08-21-OpenVPN-and-MirageVPN.html">MirageVPN and OpenVPN</a></li></ul>
|
||||
</div><div class="tag-box" id="tag-tar">
|
||||
<h3>
|
||||
<span>tar</span>
|
||||
</h3>
|
||||
<ul><li><a href="/articles/gptar.html">GPTar</a></li></ul>
|
||||
</div><div class="tag-box" id="tag-testing">
|
||||
<h3>
|
||||
<span>testing</span>
|
||||
</h3>
|
||||
<ul><li><a href="/articles/miragevpn-testing.html">Testing MirageVPN against OpenVPN™</a></li></ul>
|
||||
</div><div class="tag-box" id="tag-unicode">
|
||||
<h3>
|
||||
<span>unicode</span>
|
||||
|
|
@ -151,7 +156,7 @@
|
|||
<h3>
|
||||
<span>vpn</span>
|
||||
</h3>
|
||||
<ul><li><a href="/articles/qubes-miragevpn.html">qubes-miragevpn, a MirageVPN client for QubesOS</a></li></ul>
|
||||
<ul><li><a href="/articles/qubes-miragevpn.html">qubes-miragevpn, a MirageVPN client for QubesOS</a></li><li><a href="/articles/miragevpn-testing.html">Testing MirageVPN against OpenVPN™</a></li></ul>
|
||||
</div>
|
||||
</main>
|
||||
<footer>
|
||||
|
|
|
|||
Loading…
Reference in a new issue