sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-02 13:01:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix forwarding refcount lifecycle, VLAN accept_ra escaping, and hotplug RA coverage

Browse Source
This commit is contained in:
Viktor Liu
2026-08-10 11:42:11 +02:00
parent b870a6fb1a
commit f6867b447f
9 changed files with 193 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
client/firewall/iptables/dnat_refcount_linux_test.go
View File

@@ -1,3 +1,5 @@
//go:build privileged
package iptables
import (
@@ -72,6 +74,44 @@ func iptDnatV6(port uint16) fw.ForwardRule {
}
}
// TestIptablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
// (called on every network-map update) holds at most one reference per family
// and a single DisableRouting drops both back to zero.
func TestIptablesRouting_RepeatedEnableSingleReference(t *testing.T) {
m := newIptRefcountManager(t, true)
state := m.router.ipFwdState
require.NoError(t, m.EnableRouting(), "first enable")
require.NoError(t, m.EnableRouting(), "second enable")
require.NoError(t, m.EnableRouting(), "third enable")
v4, v6 := state.Counts()
require.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
require.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
require.NoError(t, m.DisableRouting(), "disable")
v4, v6 = state.Counts()
require.Equal(t, 0, v4, "single disable releases the v4 reference")
require.Equal(t, 0, v6, "single disable releases the v6 reference")
}
// TestIptablesRouting_DisableKeepsDNATReference verifies that an unpaired
// DisableRouting does not release references held by active DNAT rules.
func TestIptablesRouting_DisableKeepsDNATReference(t *testing.T) {
m := newIptRefcountManager(t, true)
state := m.router.ipFwdState
r1, err := m.AddDNATRule(iptDnatV6(9095))
require.NoError(t, err, "add v6 dnat")
require.NoError(t, m.DisableRouting(), "unpaired disable")
_, v6 := state.Counts()
require.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
_, v6 = state.Counts()
require.Equal(t, 0, v6, "delete releases the DNAT reference")
}
// TestIptablesDNAT_RefcountBalancedV4 covers a Balanced Add/Delete pair on v4.
func TestIptablesDNAT_RefcountBalancedV4(t *testing.T) {
m := newIptRefcountManager(t, false)