summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases/optimizations
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2022-06-17 18:51:40 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2022-06-23 19:00:02 +0200
commit45a61a755f80c52dbed747ad3c5a9a4b5f9b44ad (patch)
tree2df5b94dc8c6c6b87181731bc8eb679cacacffc7 /tests/shell/testcases/optimizations
parentfa409176af98a53304b8b448f20f4b5e5cc299fa (diff)
optimize: assume verdict is same when rules have no verdict
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/shell/testcases/optimizations')
-rw-r--r--tests/shell/testcases/optimizations/dumps/merge_reject.nft6
-rwxr-xr-xtests/shell/testcases/optimizations/merge_reject11
2 files changed, 17 insertions, 0 deletions
diff --git a/tests/shell/testcases/optimizations/dumps/merge_reject.nft b/tests/shell/testcases/optimizations/dumps/merge_reject.nft
index 9a13e2b9..c29ad6d5 100644
--- a/tests/shell/testcases/optimizations/dumps/merge_reject.nft
+++ b/tests/shell/testcases/optimizations/dumps/merge_reject.nft
@@ -5,3 +5,9 @@ table ip x {
ip daddr 172.30.254.252 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset
}
}
+table ip6 x {
+ chain y {
+ meta l4proto . ip6 daddr . tcp dport { tcp . aaaa::3 . 8080, tcp . aaaa::2 . 3306, tcp . aaaa::4 . 3306 } counter packets 0 bytes 0 reject
+ ip6 daddr aaaa::5 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset
+ }
+}
diff --git a/tests/shell/testcases/optimizations/merge_reject b/tests/shell/testcases/optimizations/merge_reject
index 497e8f64..c0ef9cac 100755
--- a/tests/shell/testcases/optimizations/merge_reject
+++ b/tests/shell/testcases/optimizations/merge_reject
@@ -13,3 +13,14 @@ RULESET="table ip x {
}"
$NFT -o -f - <<< $RULESET
+
+RULESET="table ip6 x {
+ chain y {
+ meta l4proto tcp ip6 daddr aaaa::2 tcp dport 3306 counter packets 0 bytes 0 reject
+ meta l4proto tcp ip6 daddr aaaa::3 tcp dport 8080 counter packets 0 bytes 0 reject
+ meta l4proto tcp ip6 daddr aaaa::4 tcp dport 3306 counter packets 0 bytes 0 reject
+ meta l4proto tcp ip6 daddr aaaa::5 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset
+ }
+}"
+
+$NFT -o -f - <<< $RULESET