[PATCH ipset 1/3] tests: hash:net,iface: cover cross-iface narrow-net fallthrough blocking

[PATCH ipset 1/3] tests: hash:net,iface: cover cross-iface narrow-net fallthrough blocking

[Florian Westphal]

Extend the hash:net,iface test to verify that when multiple nets of
different sizes and different interfaces overlap, the narrowest net
entry governs the lookup outcome regardless of its associated
interface. Specifically:

- A narrower net on eth0 blocks fallthrough to a broader net on eth1,
  so a query for (ip, eth1) must not match the broader eth1 entry.
- A timeout-bearing narrow entry continues to block fallthrough while
  it is still live (i.e. before GC reaps it).
- After the narrow entry on the queried interface is deleted, the
  intermediate /30 entry on another iface still prevents the broader
  /16 eth1 entry from matching.

This intentionally omits the 'has timed out but not reaped' case,
because that fails on the existing implementation, so it is added
later.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 Passes on either main or with rhashtable patches.

 tests/hash:net,iface.t | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tests/hash:net,iface.t b/tests/hash:net,iface.t
index 216f7e8a0253..6566fb407e81 100644
--- a/tests/hash:net,iface.t
+++ b/tests/hash:net,iface.t
@@ -150,6 +150,13 @@
 0 ipset -A test 1.1.1.0/28,eth0 nomatch
 # Add an even larger matching net
 0 ipset -A test 1.1.1.0/26,eth0
+# Add an even larger net for an unrelated interface
+0 ipset -A test 1.1.0.0/16,eth1
+# Add a short-lived net for one interface
+0 ipset -A test 9.9.9.0/24,eth0 timeout 2
+# Note: GC hasn't reaped the former yet when it expires below.
+# Add a permanent, broader net for another.
+0 ipset -A test 9.9.0.0/16,eth1
 # Check non-matching IP
 1 ipset -T test 1.1.1.1,eth0
 # Check matching IP from non-matchin small net
@@ -158,6 +165,11 @@
 1 ipset -T test 1.1.1.4,eth0
 # Check matching IP from even larger net
 0 ipset -T test 1.1.1.16,eth0
+# Check narrower net's entries for other iface block fallthrough to broader/unrelated iface
+# to the broader, unrelated-interface net, matching or not
+1 ipset -T test 1.1.1.1,eth1
+# The short-lived net is still live here, so it still blocks fallthrough
+1 ipset -T test 9.9.9.1,eth1
 # Update non-matching IP to matching one
 0 ipset -! -A test 1.1.1.1,eth0
 # Delete overlapping small net
@@ -176,6 +188,8 @@
 0 ipset -T test 1.1.1.1,eth0
 # Check matching IP
 0 ipset -T test 1.1.1.3,eth0
+# Check live entry on intermediate /30 net blocks fallthrough to broader eth1 net
+1 ipset -T test 1.1.1.1,eth1
 # Delete test set
 0 ipset destroy test
 # Timeout: Check that resizing keeps timeout values
-- 
2.56.0

[PATCH ipset 2/3] tests: hash:net,iface: timed-out entries must be ignored

[Florian Westphal]

When a timed-out entry in a `hash:net,iface` set expires, it should no
longer affect matching: lookups must behave as if the entry had already
been reaped by GC.

As-is, the expired entry continues to shadow the broader one until GC
removes the entry from the set, creating a window where matching is
inconsistent with the entry's logical state.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 Fails on main, but not on rhashtable v8 patches.

 tests/hash:net,iface.t | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/hash:net,iface.t b/tests/hash:net,iface.t
index 6566fb407e81..c4a8de45fced 100644
--- a/tests/hash:net,iface.t
+++ b/tests/hash:net,iface.t
@@ -190,6 +190,8 @@
 0 ipset -T test 1.1.1.3,eth0
 # Check live entry on intermediate /30 net blocks fallthrough to broader eth1 net
 1 ipset -T test 1.1.1.1,eth1
+# Check expired net no longer blocks fallthrough to the broader other-interface net
+0 ipset -T test 9.9.9.1,eth1
 # Delete test set
 0 ipset destroy test
 # Timeout: Check that resizing keeps timeout values
-- 
2.56.0

[PATCH ipset 3/3] tests: hash:net,iface.t: add test for exceeding the same-key bucket list

[Florian Westphal]

flush, add 63 duplicate keys again (should work), then add entry 64
(should fail).

This test fails before the rhashtable conversion, the old hash
implementation did not reset h->bucketsize on flush, so post-flush
next duplicate key immediately hits 'set full' error due to the
refusal to expand the bucket further.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 Fails on main, but not on rhashtable v8 patches.

 tests/hash:net,iface.t | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/hash:net,iface.t b/tests/hash:net,iface.t
index c4a8de45fced..0386cc7b7921 100644
--- a/tests/hash:net,iface.t
+++ b/tests/hash:net,iface.t
@@ -134,8 +134,12 @@
 0 n=`ipset list test | grep -v Revision: | wc -l` && test $n -eq 71
 # Flush test set
 0 ipset flush test
+# Add clashing elements after flush
+0 (set -e; for x in `seq 0 63`; do ipset add test 10.0.0.0/16,eth$x; done)
+# Check listing
+0 n=`ipset list test | grep -v Revision: | wc -l` && test $n -eq 71
 # Try to add more than 64 clashing entries
-1 (set -e; for x in `seq 0 64`; do ipset add test 10.0.0.0/16,eth$x; done)
+1 ipset add test 10.0.0.0/16,eth64
 # Delete test set
 0 ipset destroy test
 # Check all possible CIDR values
-- 
2.56.0