#!/bin/bash

# NFT_TEST_REQUIRES(NFT_TEST_HAVE_pipapo)

dumpfile=$(dirname $0)/dumps/$(basename $0).nft

$NFT -f "$dumpfile" || exit 1

die_err() {
	echo "FAIL: Command $@ failed"
	$NFT list ruleset
	exit 1
}

die_ok_err() {
	echo "FAIL: Command $@ worked but should have failed"
	$NFT list ruleset
	exit 1
}

add_add_then_create()
{
	cmd="$@"

	$NFT "add element inet filter $cmd" || die_err "add $cmd"

	# again, kernel should suppress -EEXIST
	$NFT "add element inet filter $cmd" || die_err "re-add $cmd"

	# AGAIN, kernel should report -EEXIST
	$NFT "create element inet filter $cmd" && die_ok_err "create $cmd"
}

add_create_dupe()
{
	cmd="$@"

	$NFT "add element inet filter $cmd" && die_ok_err "add $cmd (dupe)"
	$NFT "create element inet filter $cmd" && die_ok_err "create $cmd (dupe)"
}

delete()
{
	cmd="$@"

	$NFT "delete element inet filter $cmd" || die_err "delete $cmd"
	$NFT "delete element inet filter $cmd" && die_ok_err "delete $cmd"

	# destroy should NOT report an error
#	$NFT "destroy element inet filter $cmd" || die_err "destroy $cmd"
}

add_add_then_create 'saddr6limit { fee1::dead : "tarpit-pps" }'
add_add_then_create 'saddr6limit { c01a::/64 : "tarpit-bps" }'

# test same with a diffent set type (concat + interval)
add_add_then_create 'addr4limit { udp . 1.2.3.4 . 42 : "tarpit-pps", tcp . 1.2.3.4 . 42 : "tarpit-pps" }'

# now test duplicate key with *DIFFERENT* limiter, should fail
add_create_dupe 'saddr6limit { fee1::dead : "tarpit-bps" }'

add_create_dupe 'addr4limit { udp . 1.2.3.4 . 42 : "tarpit-pps", tcp . 1.2.3.4 . 42 : "http-bulk-rl-10m" }'
add_create_dupe 'addr4limit { udp . 1.2.3.4 . 43 : "tarpit-pps", tcp . 1.2.3.4 . 42 : "http-bulk-rl-10m" }'
add_create_dupe 'addr4limit { udp . 1.2.3.5 . 42 : "tarpit-pps", tcp . 1.2.3.4 . 42 : "http-bulk-rl-10m" }'
add_create_dupe 'addr4limit { udp . 1.2.3.4 . 42 : "tarpit-bps", tcp . 1.2.3.4 . 42 : "tarpit-pps" }'

# delete keys again
delete 'addr4limit { udp . 1.2.3.4 . 42 : "tarpit-pps", tcp . 1.2.3.4 . 42 :"tarpit-pps" }'

delete 'saddr6limit { fee1::dead : "tarpit-pps" }'
delete 'saddr6limit { c01a::/64 : "tarpit-bps" }'

exit 0
