#!/bin/sh
# Runs a command on Linux in a network namespace made for it, as the
# calling user with CAP_NET_ADMIN and nothing else: what the tests that
# change a kernel's routes need. For running one of them by hand, e.g.
#
#   FERRIX_ROUTES=1000000 scripts/in-namespace.sh cargo test --release \
#       -p bgp-fib --test kernel many -- --include-ignored --nocapture
set -eu
namespace="ferrix-ns-$$"
sudo modprobe dummy 2>/dev/null || true
sudo ip netns add "$namespace"
trap 'sudo ip netns del "$namespace"' EXIT
sudo ip netns exec "$namespace" ip link set lo up
# Only the variables that are set are passed on: cargo refuses an empty
# CARGO_TARGET_DIR, and the build settings have to be the same as the
# prebuild's in scripts/kernel-tests.sh for it to be reused.
sudo ip netns exec "$namespace" \
    setpriv --reuid "$(id -u)" --regid "$(id -g)" --init-groups \
    --inh-caps +net_admin --ambient-caps +net_admin \
    env PATH="$PATH" HOME="$HOME" \
    ${CARGO_TARGET_DIR:+CARGO_TARGET_DIR="$CARGO_TARGET_DIR"} \
    ${RUSTFLAGS:+RUSTFLAGS="$RUSTFLAGS"} \
    ${CARGO_TERM_COLOR:+CARGO_TERM_COLOR="$CARGO_TERM_COLOR"} \
    ${FERRIX_ROUTES:+FERRIX_ROUTES="$FERRIX_ROUTES"} "$@"