Blame SOURCES/0038-tests-shell-Test-for-fixed-extension-registration.patch

b144b7
From f5185f4efad409fc7ec4ae05267b642ee4103a6c Mon Sep 17 00:00:00 2001
b144b7
From: Phil Sutter <phil@nwl.cc>
b144b7
Date: Fri, 4 Dec 2020 17:44:51 +0100
b144b7
Subject: [PATCH] tests/shell: Test for fixed extension registration
b144b7
b144b7
Use strace to look at iptables-restore behaviour with typically
b144b7
problematic input (conntrack revision 0 is no longer supported by
b144b7
current kernels) to make sure the fix in commit a1eaaceb0460b
b144b7
("libxtables: Simplify pending extension registration") is still
b144b7
effective.
b144b7
b144b7
Signed-off-by: Phil Sutter <phil@nwl.cc>
b144b7
(cherry picked from commit 93d0c97e8b6713f51ba679e01a1338d4f9076e7c)
b144b7
Signed-off-by: Phil Sutter <psutter@redhat.com>
b144b7
---
b144b7
 .../0017-pointless-compat-checks_0            | 25 +++++++++++++++++++
b144b7
 1 file changed, 25 insertions(+)
b144b7
 create mode 100755 iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
b144b7
b144b7
diff --git a/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0 b/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
b144b7
new file mode 100755
b144b7
index 0000000000000..cf73de32df409
b144b7
--- /dev/null
b144b7
+++ b/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
b144b7
@@ -0,0 +1,25 @@
b144b7
+#!/bin/bash
b144b7
+
b144b7
+# A bug in extension registration would leave unsupported older extension
b144b7
+# revisions in pending list and get compatibility checked again for each rule
b144b7
+# using them. With SELinux enabled, the resulting socket() call per rule leads
b144b7
+# to significant slowdown (~50% performance in worst cases).
b144b7
+
b144b7
+set -e
b144b7
+
b144b7
+strace --version >/dev/null || { echo "skip for missing strace"; exit 0; }
b144b7
+
b144b7
+RULESET="$(
b144b7
+	echo "*filter"
b144b7
+	for ((i = 0; i < 100; i++)); do
b144b7
+		echo "-A FORWARD -m conntrack --ctstate NEW"
b144b7
+	done
b144b7
+	echo "COMMIT"
b144b7
+)"
b144b7
+
b144b7
+cmd="$XT_MULTI iptables-restore"
b144b7
+socketcount=$(strace -esocket $cmd <<< "$RULESET" 2>&1 | wc -l)
b144b7
+
b144b7
+# unpatched iptables-restore would open 111 sockets,
b144b7
+# patched only 12 but keep a certain margin for future changes
b144b7
+[[ $socketcount -lt 20 ]]
b144b7
-- 
b144b7
2.28.0
b144b7