From 45a61a755f80c52dbed747ad3c5a9a4b5f9b44ad Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 17 Jun 2022 18:51:40 +0200 Subject: optimize: assume verdict is same when rules have no verdict Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/optimizations/dumps/merge_reject.nft | 6 ++++++ tests/shell/testcases/optimizations/merge_reject | 11 +++++++++++ 2 files changed, 17 insertions(+) (limited to 'tests') diff --git a/tests/shell/testcases/optimizations/dumps/merge_reject.nft b/tests/shell/testcases/optimizations/dumps/merge_reject.nft index 9a13e2b9..c29ad6d5 100644 --- a/tests/shell/testcases/optimizations/dumps/merge_reject.nft +++ b/tests/shell/testcases/optimizations/dumps/merge_reject.nft @@ -5,3 +5,9 @@ table ip x { ip daddr 172.30.254.252 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset } } +table ip6 x { + chain y { + meta l4proto . ip6 daddr . tcp dport { tcp . aaaa::3 . 8080, tcp . aaaa::2 . 3306, tcp . aaaa::4 . 3306 } counter packets 0 bytes 0 reject + ip6 daddr aaaa::5 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset + } +} diff --git a/tests/shell/testcases/optimizations/merge_reject b/tests/shell/testcases/optimizations/merge_reject index 497e8f64..c0ef9cac 100755 --- a/tests/shell/testcases/optimizations/merge_reject +++ b/tests/shell/testcases/optimizations/merge_reject @@ -13,3 +13,14 @@ RULESET="table ip x { }" $NFT -o -f - <<< $RULESET + +RULESET="table ip6 x { + chain y { + meta l4proto tcp ip6 daddr aaaa::2 tcp dport 3306 counter packets 0 bytes 0 reject + meta l4proto tcp ip6 daddr aaaa::3 tcp dport 8080 counter packets 0 bytes 0 reject + meta l4proto tcp ip6 daddr aaaa::4 tcp dport 3306 counter packets 0 bytes 0 reject + meta l4proto tcp ip6 daddr aaaa::5 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset + } +}" + +$NFT -o -f - <<< $RULESET -- cgit v1.2.3