diff options
| author | Florian Westphal <fw@strlen.de> | 2025-03-20 09:39:20 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2025-03-20 11:43:16 +0100 |
| commit | 43cf4a2973ee9e3ab20edce47c6a054485707592 (patch) | |
| tree | 332da3f9b0cab0707e2ef846b4f98db0018ac64b /tests/shell | |
| parent | b00fc8cd1379f6e403538943d55d297b624f185b (diff) | |
evaluate: don't allow nat map with specified protocol
Included bogon asserts:
src/netlink_linearize.c:1305: netlink_gen_nat_stmt: Assertion `stmt->nat.proto == NULL' failed.
The comment right above the assertion says:
nat_stmt evaluation step doesn't allow
STMT_NAT_F_CONCAT && stmt->nat.proto.
... except it does allow it. Disable this.
Fixes: c68314dd4263 ("src: infer NAT mapping with concatenation from set")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/shell')
| -rw-r--r-- | tests/shell/testcases/bogons/nat_map_and_protocol_assert | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/tests/shell/testcases/bogons/nat_map_and_protocol_assert b/tests/shell/testcases/bogons/nat_map_and_protocol_assert new file mode 100644 index 00000000..67f2ae87 --- /dev/null +++ b/tests/shell/testcases/bogons/nat_map_and_protocol_assert @@ -0,0 +1,5 @@ +table t { + chain y { + snat to ip saddr . tcp sport map { 1.1.1.1 . 1 : 1.1.1.2 . 1 } : 6 + } +} |