[PATCH ipset 1/3] tests: hash:net,iface: cover cross-iface narrow-net fallthrough blocking

[Florian Westphal <fw@strlen.de>]

Extend the hash:net,iface test to verify that when multiple nets of
different sizes and different interfaces overlap, the narrowest net
entry governs the lookup outcome regardless of its associated
interface. Specifically:

- A narrower net on eth0 blocks fallthrough to a broader net on eth1,
  so a query for (ip, eth1) must not match the broader eth1 entry.
- A timeout-bearing narrow entry continues to block fallthrough while
  it is still live (i.e. before GC reaps it).
- After the narrow entry on the queried interface is deleted, the
  intermediate /30 entry on another iface still prevents the broader
  /16 eth1 entry from matching.

This intentionally omits the 'has timed out but not reaped' case,
because that fails on the existing implementation, so it is added
later.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 Passes on either main or with rhashtable patches.

 tests/hash:net,iface.t | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tests/hash:net,iface.t b/tests/hash:net,iface.t
index 216f7e8a0253..6566fb407e81 100644
--- a/tests/hash:net,iface.t
+++ b/tests/hash:net,iface.t
@@ -150,6 +150,13 @@
 0 ipset -A test 1.1.1.0/28,eth0 nomatch
 # Add an even larger matching net
 0 ipset -A test 1.1.1.0/26,eth0
+# Add an even larger net for an unrelated interface
+0 ipset -A test 1.1.0.0/16,eth1
+# Add a short-lived net for one interface
+0 ipset -A test 9.9.9.0/24,eth0 timeout 2
+# Note: GC hasn't reaped the former yet when it expires below.
+# Add a permanent, broader net for another.
+0 ipset -A test 9.9.0.0/16,eth1
 # Check non-matching IP
 1 ipset -T test 1.1.1.1,eth0
 # Check matching IP from non-matchin small net
@@ -158,6 +165,11 @@
 1 ipset -T test 1.1.1.4,eth0
 # Check matching IP from even larger net
 0 ipset -T test 1.1.1.16,eth0
+# Check narrower net's entries for other iface block fallthrough to broader/unrelated iface
+# to the broader, unrelated-interface net, matching or not
+1 ipset -T test 1.1.1.1,eth1
+# The short-lived net is still live here, so it still blocks fallthrough
+1 ipset -T test 9.9.9.1,eth1
 # Update non-matching IP to matching one
 0 ipset -! -A test 1.1.1.1,eth0
 # Delete overlapping small net
@@ -176,6 +188,8 @@
 0 ipset -T test 1.1.1.1,eth0
 # Check matching IP
 0 ipset -T test 1.1.1.3,eth0
+# Check live entry on intermediate /30 net blocks fallthrough to broader eth1 net
+1 ipset -T test 1.1.1.1,eth1
 # Delete test set
 0 ipset destroy test
 # Timeout: Check that resizing keeps timeout values
-- 
2.56.0