On Thu, Sep 22, 2022 at 10:47:26AM +0800, Bin Meng wrote:
> On Thu, Sep 22, 2022 at 1:23 AM Daniel P. Berrangé <berra...@redhat.com>
> wrote:
> >
> > On Wed, Sep 21, 2022 at 05:51:33PM +0100, Dr. David Alan Gilbert wrote:
> > > * Bin Meng (bmeng...@gmail.com) wrote:
> > > > From: Bin Meng <bin.m...@windriver.com>
> > > >
> > > > Some migration test cases use TLS to communicate, but they fail on
> > > > Windows with the following error messages:
> > > >
> > > > qemu-system-x86_64: TLS handshake failed: Insufficient credentials
> > > > for that request.
> > > > qemu-system-x86_64: TLS handshake failed: Error in the pull function.
> > > > query-migrate shows failed migration: TLS handshake failed: Error in
> > > > the pull function.
> > > >
> > > > Disable them temporarily.
> > > >
> > > > Signed-off-by: Bin Meng <bin.m...@windriver.com>
> > > > ---
> > > > I am not familar with the gnutls and simply enabling the gnutls debug
> > > > output does not give me an immedidate hint on why it's failing on
> > > > Windows. Disable these cases for now until someone or maintainers
> > > > who may want to test this on Windows.
> > >
> > > Copying in Dan Berrange, he's our expert on weird TLS failures.
> >
> > Seems to match this:
> >
> > https://gnutls.org/faq.html#key-usage-violation2
> >
> > which suggests we have a configuration mis-match.
> >
> > I'm surprised to see you are only needing to disable the TLS PSK tests,
> > not the TLS x509 tests.
>
> The TLS x509 qtests all passed.
>
> >
> > I'd like to know if tests/unit/test-crypto-tlssession passes.
>
> These unit tests currently are not built on Windows as they simply
> don't build due to usage of socketpair().
Doh, yes, that's rather annoying, as debugging this problem in the
unit tests would be easier than in qtests.
> > If so, it might suggest we are missing 'priority: NORMAL' property
> > when configuring TLS creds for the migration test.
>
> I did the following changes but the error is still the same:
>
> diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
> index dbee9b528a..c1e3f11873 100644
> --- a/tests/qtest/migration-test.c
> +++ b/tests/qtest/migration-test.c
> @@ -788,7 +788,8 @@ test_migrate_tls_psk_start_common(QTestState *from,
> " 'id': 'tlscredspsk0',"
> " 'endpoint': 'client',"
> " 'dir': %s,"
> - " 'username': 'qemu'} }",
> + " 'username': 'qemu',"
> + " 'priority': 'NORMAL'} }",
> data->workdir);
> qobject_unref(rsp);
> @@ -797,7 +798,8 @@ test_migrate_tls_psk_start_common(QTestState *from,
> " 'arguments': { 'qom-type': 'tls-creds-psk',"
> " 'id': 'tlscredspsk0',"
> " 'endpoint': 'server',"
> - " 'dir': %s } }",
> + " 'dir': %s,"
> + " 'priority': 'NORMAL'} }",
> mismatch ? data->workdiralt : data->workdir);
> qobject_unref(rsp);
>
> I am not sure whether I did the right changes.
That ought to have been sufficient, if priority strings were the
problem.
I think we'd need the debug output from gnutls - could you edit crypto/init.c
and uncomment the '#define DEBUG_GNUTLS' line near the top.
If you can post the output you get from a single migration-test test case
involving PSK, it might be enough to diagnose why gnutls is failing.
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
