diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-03-03 12:20:29 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-03-03 12:27:33 +0100 |
| commit | 99eb46969f3d7ccd37899f2755055fe7511c46b0 (patch) | |
| tree | 2257e10537fd5c8f7834cfb4483855f24fb849b3 /tests | |
| parent | e8f0fa21fd77ecc51faf39cefa3cccdb7d6a30cf (diff) | |
optimize: fix vmap with anonymous sets
The following example ruleset crashes:
table inet a {
chain b {
tcp dport { 1 } accept
tcp dport 2-3 drop
}
}
because handling for EXPR_SET is missing.
Fixes: 1542082e259b ("optimize: merge same selector with different verdict into verdict map")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft | 4 | ||||
| -rwxr-xr-x | tests/shell/testcases/optimizations/merge_stmts_vmap | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft b/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft index 9fa19afc..42757295 100644 --- a/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft +++ b/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft @@ -2,4 +2,8 @@ table ip x { chain y { ct state vmap { invalid : drop, established : accept, related : accept } } + + chain z { + tcp dport vmap { 1 : accept, 2-3 : drop } + } } diff --git a/tests/shell/testcases/optimizations/merge_stmts_vmap b/tests/shell/testcases/optimizations/merge_stmts_vmap index f838fcfe..6511c7b2 100755 --- a/tests/shell/testcases/optimizations/merge_stmts_vmap +++ b/tests/shell/testcases/optimizations/merge_stmts_vmap @@ -7,6 +7,10 @@ RULESET="table ip x { ct state invalid drop ct state established,related accept } + chain z { + tcp dport { 1 } accept + tcp dport 2-3 drop + } }" $NFT -o -f - <<< $RULESET |