| #!/bin/bash |
| |
| # test for iptables-restore --noflush skipping an explicitly requested chain |
| # flush because the chain did not exist when cache was fetched. In order to |
| # expect for that chain to appear when refreshing the transaction (due to a |
| # concurrent ruleset change), the chain flush job has to be present in batch |
| # job list (although disabled at first). |
| # The input line requesting chain flush is ':FOO - [0:0]'. RS1 and RS2 contents |
| # are crafted to cause EBUSY when deleting the BAR* chains if FOO is not |
| # flushed in the same transaction. |
| |
| set -e |
| |
| RS="*filter |
| :INPUT ACCEPT [12024:3123388] |
| :FORWARD ACCEPT [0:0] |
| :OUTPUT ACCEPT [12840:2144421] |
| :FOO - [0:0] |
| :BAR0 - [0:0] |
| :BAR1 - [0:0] |
| :BAR2 - [0:0] |
| :BAR3 - [0:0] |
| :BAR4 - [0:0] |
| :BAR5 - [0:0] |
| :BAR6 - [0:0] |
| :BAR7 - [0:0] |
| :BAR8 - [0:0] |
| :BAR9 - [0:0] |
| " |
| |
| RS1="$RS |
| -X BAR3 |
| -X BAR6 |
| -X BAR9 |
| -A FOO -s 9.9.0.1/32 -j BAR1 |
| -A FOO -s 9.9.0.2/32 -j BAR2 |
| -A FOO -s 9.9.0.4/32 -j BAR4 |
| -A FOO -s 9.9.0.5/32 -j BAR5 |
| -A FOO -s 9.9.0.7/32 -j BAR7 |
| -A FOO -s 9.9.0.8/32 -j BAR8 |
| COMMIT |
| " |
| |
| RS2="$RS |
| -X BAR2 |
| -X BAR5 |
| -X BAR7 |
| -A FOO -s 9.9.0.1/32 -j BAR1 |
| -A FOO -s 9.9.0.3/32 -j BAR3 |
| -A FOO -s 9.9.0.4/32 -j BAR4 |
| -A FOO -s 9.9.0.6/32 -j BAR6 |
| -A FOO -s 9.9.0.8/32 -j BAR8 |
| -A FOO -s 9.9.0.9/32 -j BAR9 |
| COMMIT |
| " |
| |
| NORS="*filter |
| COMMIT |
| " |
| |
| for n in $(seq 1 10); do |
| $XT_MULTI iptables-restore <<< "$NORS" |
| $XT_MULTI iptables-restore --noflush -w <<< "$RS1" & |
| $XT_MULTI iptables-restore --noflush -w <<< "$RS2" & |
| wait -n |
| wait -n |
| done |
