summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases/sets/dumps/0024named_objects_0.nft
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2020-08-03 16:06:21 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2020-08-04 13:42:29 +0200
commit80140a4c4f661a2881a41dc57b4baa3e45f12b55 (patch)
tree195f3a1ff072527e8526b65408bbec3cd56ff57d /tests/shell/testcases/sets/dumps/0024named_objects_0.nft
parent2ff9af4370e12a30714dbe62eeccb141d1afb534 (diff)
tests: 0044interval_overlap_0: Repeat insertion tests with timeout
Mike Dillinger reported issues with insertion of entries into sets supporting intervals that were denied because of false conflicts with elements that were already expired. Partial failures would occur to, leading to the generation of new intervals the user didn't specify, as only the opening or the closing elements wouldn't be inserted. The reproducer provided by Mike looks like this: #!/bin/bash nft list set ip filter blacklist4-ip-1m for ((i=1;i<=10;i++)); do nft add element filter blacklist4-ip-1m {$i.$i.$i.$i} sleep 1 done nft list set ip filter blacklist4-ip-1m which, run in a loop at different intervals, show the different kind of failures. Extend the existing test case for overlapping and non-overlapping intervals to systematically cover sets with a configured timeout. As reported by Pablo, the test would fail if we keep a one-second timeout if it runs on a "slow" kernel (e.g. with KASan), using the libtool wrapper in src/nft as $NFT, because we can't issue 218 commands within one second. To avoid that, introduce an adaptive timeout based on how many times we can list a single entry with a fixed one-second timeout. On a single 2.9GHz AMD Epyc 7351 thread: test run nft commands/s timeout - src/nft libtool wrapper, KASan: 68.4s 10 32s - nft binary, KASan: 5.1s 168 2s - src/nft libtool wrapper, w/o KASan: 18.3s 37 8s - nft binary, w/o KASan: 2.4s 719 1s While at it, fix expectation for insertion of '15-20 . 50-60' (it's expected to succeed, given the list), and the reason why I didn't notice: a simple command preceded by ! won't actually result in the shell exiting, even if it fails. Add some clearer failure reports too. v2: - adjust set timeouts to nft commands/s - fix checks on expected outcome of insertions and reports Reported-by: Mike Dillinger <miked@softtalker.com> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/shell/testcases/sets/dumps/0024named_objects_0.nft')
0 files changed, 0 insertions, 0 deletions