nlink 0.28.0

//! Integration test entry point.
//!
//! This file serves as the entry point for integration tests.
//! The actual tests are organized in the `integration/` directory.
//!
//! # Running Tests
//!
//! Integration tests require root privileges:
//!
//! ```bash
//! # Run all integration tests
//! sudo cargo test --test integration
//!
//! # Run specific test module
//! sudo cargo test --test integration link
//!
//! # Run a single test
//! sudo cargo test --test integration test_create_veth_pair
//!
//! # Run with output
//! sudo cargo test --test integration -- --nocapture
//! ```
//!
//! # Test Organization
//!
//! - `link.rs` - Link creation, modification, and deletion
//! - `address.rs` - IP address management
//! - `route.rs` - Route management
//! - `tc.rs` - Traffic control (qdisc, class, filter)
//! - `events.rs` - Event monitoring

#[macro_use]
#[path = "common/mod.rs"]
mod common;

#[path = "integration/link.rs"]
mod link;

#[path = "integration/address.rs"]
mod address;

#[path = "integration/route.rs"]
mod route;

#[path = "integration/tc.rs"]
mod tc;

#[path = "integration/events.rs"]
mod events;

#[path = "integration/config.rs"]
mod config;

// Plan 186 — VLAN parent ifindex race repro + topo-sort
// regression coverage. Lives in its own module so the focused
// scenarios stay out of the broader `config` integration
// surface.
#[path = "integration/network_config_apply.rs"]
mod network_config_apply;

#[path = "integration/ratelimit.rs"]
mod ratelimit;

#[path = "integration/impair.rs"]
mod impair;

#[path = "integration/diagnostics.rs"]
mod diagnostics;

#[path = "integration/timeout.rs"]
mod timeout;

#[path = "integration/sysctl.rs"]
mod sysctl;

#[path = "integration/namespace_spawn.rs"]
mod namespace_spawn;

#[path = "integration/namespace_path.rs"]
mod namespace_path;

// Feature-gated: the privileged integration workflow builds with
// `lab,sockdiag,namespace_watcher` so the inotify round-trip (#183)
// runs there.
#[cfg(feature = "namespace_watcher")]
#[path = "integration/namespace_watcher.rs"]
mod namespace_watcher;

#[path = "integration/conntrack.rs"]
mod conntrack;

// Feature-gated: only compiles when `sockdiag` is enabled. The
// privileged integration workflow builds with `lab,sockdiag` so the
// on-kernel bytecode validation runs there.
#[cfg(feature = "sockdiag")]
#[path = "integration/sockdiag_bytecode.rs"]
mod sockdiag_bytecode;

// Unprivileged by design — sock_diag dumps your own sockets without any
// capability, so these run for the non-root maintainer too.
#[cfg(feature = "sockdiag")]
#[path = "integration/sockdiag_correctness.rs"]
mod sockdiag_correctness;

#[path = "integration/neigh.rs"]
mod neigh;

// Plan 166 backfill — root-gated tests for the headline 0.16 features.
// Each module gates on `require_root!()` so this all early-returns
// when run as a regular user.

#[path = "integration/ergonomics.rs"]
mod ergonomics;

#[path = "integration/streaming.rs"]
mod streaming;

#[path = "integration/flowtable.rs"]
mod flowtable;

#[path = "integration/nftables_diag.rs"]
mod nftables_diag;

#[path = "integration/nftables_reconcile.rs"]
mod nftables_reconcile;

#[path = "integration/syscall_batch.rs"]
mod syscall_batch;

#[path = "integration/pool.rs"]
mod pool;

// Plan 194 — concurrent stress + seq-routing regression.
// Spawns 16 concurrent dumps on a shared Arc<Connection>
// and 16 concurrent LabNamespace::new calls. Both root-gated.
#[path = "integration/concurrent_stress.rs"]
mod concurrent_stress;

// 0.19 cycle backfill — Plan 188/196/199/200/202 round-trips
// surfaced by the post-cycle audit as kernel-touching surfaces
// with only unit-test coverage. All root-gated; WG/nft tests
// also gated by require_module!().
#[path = "integration/cycle_0_19_backfill.rs"]
mod cycle_0_19_backfill;

// Plan 221 — 0.19.1 XFRM hotfix regression tests. Root-gated +
// `xfrm_user` module-gated. Lock the corrected constant + dispatch
// values so a future commit can't re-introduce the bug class.
#[path = "integration/xfrm_hotfix.rs"]
mod xfrm_hotfix;

// Plan 197 — OVPN GENL family integration tests. Root-gated +
// `ovpn` module-gated (kernel 6.16+). Exercises peer + key ops
// + the declarative OvpnConfig diff + apply cycle.
#[path = "integration/ovpn.rs"]
mod ovpn;

// #190, #195, #199 — nftables safety. A foreign table must survive an
// apply that doesn't declare it; rules must install in declaration
// order; a mid-batch kernel rejection must surface as that error
// rather than an opaque 30s timeout.
#[path = "integration/nftables_safety.rs"]
mod nftables_safety;

// #191-#194, #218 — psched tick conversion. The unit tests pin the
// bytes nlink emits; these pin that the *kernel* accepts them and
// reads back what we wrote. Needed because the pre-fix writer and
// reader were wrong in the same direction and agreed with each other.
#[path = "integration/psched_ticks.rs"]
mod psched_ticks;

// Plan 234 (0.21) — Dispatcher foundation: ENOBUFS routing to
// ResyncMarker::ResyncStart, per-family wiring smoke checks,
// concurrent-request coexistence with dispatcher subscribers.
#[path = "integration/dispatcher.rs"]
mod dispatcher;

// #253 — the rtnetlink + uevent netdev lifecycle join. Root-gated +
// `veth` module-gated. The unit tests pin the join's logic with
// hand-fed streams; this pins the kernel facts underneath it — that a
// net uevent inside a namespace reaches a socket opened in that
// namespace, and that its IFINDEX= agrees with rtnetlink's.
#[path = "integration/netdev_lifecycle.rs"]
mod netdev_lifecycle;

// #251 — uevent socket hardening. Unprivileged by design: attaching a
// classic-BPF socket filter and reading uevents both need no
// capability, and it is the kernel's BPF verifier — not the privilege
// — that these check.
#[path = "integration/uevent_filter.rs"]
mod uevent_filter;

// #292 — extended-ack parsing, end to end. The unit tests synthesise the
// capped payload; only the kernel sends the shape that was actually
// arriving.
#[path = "integration/ext_ack.rs"]
mod ext_ack;

// #275 — MPTCP endpoint wiring. `dev(name)` was stored and never
// resolved, so endpoints had no interface binding; and the port's byte
// order is only checkable against an independent reader, because nlink
// writes and reads it symmetrically.
#[path = "integration/mptcp_pm.rs"]
mod mptcp_pm;

// #275 — declared values that the writers never read. Each test asserts
// the *value* landed, not that the call returned Ok; asserting Ok is
// what let these ship.
#[path = "integration/declared_input.rs"]
mod declared_input;
// #258/#268/#269/#270 — the TC shaping recipes. The HTB `default` and
// the class it names must agree (three bugs shipped because nothing
// checked), reconcile must notice an edited match criterion, and
// declaring a clsact must not delete the root qdisc.
#[path = "integration/tc_shaping.rs"]
mod tc_shaping;
// #267 — NLMSG_DONE's result code. Unprivileged: sock_diag dumps your
// own sockets without any capability, and a protocol with no diag
// handler answers DONE-with-ENOENT, which used to read as an empty list.
#[cfg(feature = "sockdiag")]
#[path = "integration/dump_termination.rs"]
mod dump_termination;

// #276, #280 — public API reachability. The integration target is a
// separate crate, so it sees what a downstream user sees.
#[path = "integration/api_surface.rs"]
mod api_surface;