|
Packit |
c5a612 |
#!/bin/bash
|
|
Packit |
c5a612 |
|
|
Packit |
c5a612 |
set -e
|
|
Packit |
c5a612 |
|
|
Packit |
c5a612 |
# Expose how naive cache update logic (i.e., drop cache and repopulate from
|
|
Packit |
c5a612 |
# kernel ruleset) may mess things up. The following input does:
|
|
Packit |
c5a612 |
#
|
|
Packit |
c5a612 |
# list ruleset -> populate the cache, cache->genid is non-zero
|
|
Packit |
c5a612 |
# add table ip t -> make kernel's genid increment (cache->genid remains
|
|
Packit |
c5a612 |
# unchanged)
|
|
Packit |
c5a612 |
# add table ip t2; -> first command of batch, new table t2 is added to the cache
|
|
Packit |
c5a612 |
# add chain ip t2 c -> second command of batch, triggers cache_update() which
|
|
Packit |
c5a612 |
# removes table t2 from it
|
|
Packit |
c5a612 |
|
|
Packit |
c5a612 |
$NFT -i >/dev/null <
|
|
Packit |
c5a612 |
list ruleset
|
|
Packit |
c5a612 |
add table ip t
|
|
Packit |
c5a612 |
add table ip t2; add chain ip t2 c
|
|
Packit |
c5a612 |
EOF
|
|
Packit |
c5a612 |
|
|
Packit |
c5a612 |
# The following test exposes a problem with simple locking of cache when local
|
|
Packit |
c5a612 |
# entries are added:
|
|
Packit |
c5a612 |
#
|
|
Packit |
c5a612 |
# add table ip t3 -> cache would be locked without previous update
|
|
Packit |
c5a612 |
# add chain ip t c -> table t is not found due to no cache update happening
|
|
Packit |
c5a612 |
|
|
Packit |
c5a612 |
$NFT -i >/dev/null <
|
|
Packit |
c5a612 |
add table ip t3; add chain ip t c
|
|
Packit |
c5a612 |
EOF
|
|
Packit |
c5a612 |
|
|
Packit |
c5a612 |
# The following test exposes a problem with incremental cache update when
|
|
Packit |
c5a612 |
# reading commands from a file that add a rule using the "index" keyword.
|
|
Packit |
c5a612 |
#
|
|
Packit |
c5a612 |
# add rule ip t4 c meta l4proto icmp accept -> rule to reference in next step
|
|
Packit |
c5a612 |
# add rule ip t4 c index 0 drop -> index 0 is not found due to rule cache not
|
|
Packit |
c5a612 |
# being updated
|
|
Packit |
c5a612 |
# add rule ip t4 c index 2 drop -> index 2 is not found due to igmp rule being
|
|
Packit |
c5a612 |
# in same transaction and therefore not having
|
|
Packit |
c5a612 |
# an allocated handle
|
|
Packit |
c5a612 |
$NFT -i >/dev/null <
|
|
Packit |
c5a612 |
add table ip t4; add chain ip t4 c
|
|
Packit |
c5a612 |
add rule ip t4 c meta l4proto icmp accept
|
|
Packit |
c5a612 |
EOF
|
|
Packit |
c5a612 |
$NFT -f - >/dev/null <
|
|
Packit |
c5a612 |
add rule ip t4 c index 0 drop
|
|
Packit |
c5a612 |
EOF
|
|
Packit |
c5a612 |
$NFT -f - >/dev/null <
|
|
Packit |
c5a612 |
add rule ip t4 c meta l4proto igmp accept
|
|
Packit |
c5a612 |
add rule ip t4 c index 2 drop
|
|
Packit |
c5a612 |
EOF
|