diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-06-17 18:51:40 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-06-23 19:00:02 +0200 |
| commit | 45a61a755f80c52dbed747ad3c5a9a4b5f9b44ad (patch) | |
| tree | 2df5b94dc8c6c6b87181731bc8eb679cacacffc7 | |
| parent | fa409176af98a53304b8b448f20f4b5e5cc299fa (diff) | |
optimize: assume verdict is same when rules have no verdict
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | src/optimize.c | 3 | ||||
| -rw-r--r-- | tests/shell/testcases/optimizations/dumps/merge_reject.nft | 6 | ||||
| -rwxr-xr-x | tests/shell/testcases/optimizations/merge_reject | 11 |
3 files changed, 19 insertions, 1 deletions
diff --git a/src/optimize.c b/src/optimize.c index e4508fa5..c6b85d74 100644 --- a/src/optimize.c +++ b/src/optimize.c @@ -944,7 +944,8 @@ static enum stmt_types merge_stmt_type(const struct optimize_ctx *ctx) } } - return STMT_INVALID; + /* actually no verdict, this assumes rules have the same verdict. */ + return STMT_VERDICT; } static void merge_rules(const struct optimize_ctx *ctx, diff --git a/tests/shell/testcases/optimizations/dumps/merge_reject.nft b/tests/shell/testcases/optimizations/dumps/merge_reject.nft index 9a13e2b9..c29ad6d5 100644 --- a/tests/shell/testcases/optimizations/dumps/merge_reject.nft +++ b/tests/shell/testcases/optimizations/dumps/merge_reject.nft @@ -5,3 +5,9 @@ table ip x { ip daddr 172.30.254.252 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset } } +table ip6 x { + chain y { + meta l4proto . ip6 daddr . tcp dport { tcp . aaaa::3 . 8080, tcp . aaaa::2 . 3306, tcp . aaaa::4 . 3306 } counter packets 0 bytes 0 reject + ip6 daddr aaaa::5 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset + } +} diff --git a/tests/shell/testcases/optimizations/merge_reject b/tests/shell/testcases/optimizations/merge_reject index 497e8f64..c0ef9cac 100755 --- a/tests/shell/testcases/optimizations/merge_reject +++ b/tests/shell/testcases/optimizations/merge_reject @@ -13,3 +13,14 @@ RULESET="table ip x { }" $NFT -o -f - <<< $RULESET + +RULESET="table ip6 x { + chain y { + meta l4proto tcp ip6 daddr aaaa::2 tcp dport 3306 counter packets 0 bytes 0 reject + meta l4proto tcp ip6 daddr aaaa::3 tcp dport 8080 counter packets 0 bytes 0 reject + meta l4proto tcp ip6 daddr aaaa::4 tcp dport 3306 counter packets 0 bytes 0 reject + meta l4proto tcp ip6 daddr aaaa::5 tcp dport 3306 counter packets 0 bytes 0 reject with tcp reset + } +}" + +$NFT -o -f - <<< $RULESET |