tests/shell: add JSON dump files

Generate and add ".json-nft" files. These files contain the output of
`nft -j list ruleset` after the test. Also, "test-wrapper.sh" will
compare the current ruleset against the ".json-nft" files and test them
with "nft -j --check -f $FILE`. These are useful extra tests, that we
almost get for free.

Note that for some JSON dumps, `nft -f --check` fails (or prints
something). For those tests no *.json-nft file is added. The bugs needs
to be fixed first.

An example of such an issue is:

    $ DUMPGEN=all ./tests/shell/run-tests.sh tests/shell/testcases/maps/nat_addr_port

which gives a file "rc-failed-chkdump" with

    Command `./tests/shell/../../src/nft -j --check -f "tests/shell/testcases/maps/dumps/nat_addr_port.json-nft"` failed
    >>>>
    internal:0:0-0: Error: Invalid map type 'ipv4_addr . inet_service'.

    internal:0:0-0: Error: Parsing command array at index 3 failed.

    internal:0:0-0: Error: unqualified type integer specified in map definition. Try "typeof expression" instead of "type datatype".

    <<<<

Tests like "tests/shell/testcases/nft-f/0012different_defines_0" and
"tests/shell/testcases/nft-f/0024priority_0" also don't get a .json-nft
dump yet, because their output is not stable. That needs fixing too.

Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Thomas Haller <thaller@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>

17 files changed, 17 insertions, 0 deletions

diff --git a/tests/shell/testcases/optimizations/dumps/dependency_kill.json-nft b/tests/shell/testcases/optimizations/dumps/dependency_kill.json-nft
new file mode 100644
index 00000000..18efc416
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/dependency_kill.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "bridge", "name": "foo", "handle": 1}}, {"chain": {"family": "bridge", "table": "foo", "name": "bar", "handle": 1}}, {"rule": {"family": "bridge", "table": "foo", "chain": "bar", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "protocol"}}, "right": "ip"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "bridge", "table": "foo", "chain": "bar", "handle": 3, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "protocol"}}, "right": "ip6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "bridge", "table": "foo", "chain": "bar", "handle": 4, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ether", "field": "type"}}, "right": "ip"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "bridge", "table": "foo", "chain": "bar", "handle": 5, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ether", "field": "type"}}, "right": "ip6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"table": {"family": "ip", "name": "foo", "handle": 2}}, {"chain": {"family": "ip", "table": "foo", "name": "bar", "handle": 1}}, {"rule": {"family": "ip", "table": "foo", "chain": "bar", "handle": 2, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "ip", "table": "foo", "chain": "bar", "handle": 3, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "protocol"}}, "right": "ip6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "ip", "table": "foo", "chain": "bar", "handle": 4, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "ip", "table": "foo", "chain": "bar", "handle": 5, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ether", "field": "type"}}, "right": "ip6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"table": {"family": "ip6", "name": "foo", "handle": 3}}, {"chain": {"family": "ip6", "table": "foo", "name": "bar", "handle": 1}}, {"rule": {"family": "ip6", "table": "foo", "chain": "bar", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "protocol"}}, "right": "ip"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "ip6", "table": "foo", "chain": "bar", "handle": 3, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "ip6", "table": "foo", "chain": "bar", "handle": 4, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ether", "field": "type"}}, "right": "ip"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "ip6", "table": "foo", "chain": "bar", "handle": 5, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"table": {"family": "netdev", "name": "foo", "handle": 4}}, {"chain": {"family": "netdev", "table": "foo", "name": "bar", "handle": 1}}, {"rule": {"family": "netdev", "table": "foo", "chain": "bar", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "protocol"}}, "right": "ip"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "netdev", "table": "foo", "chain": "bar", "handle": 3, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "protocol"}}, "right": "ip6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "netdev", "table": "foo", "chain": "bar", "handle": 4, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ether", "field": "type"}}, "right": "ip"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "netdev", "table": "foo", "chain": "bar", "handle": 5, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ether", "field": "type"}}, "right": "ip6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"table": {"family": "inet", "name": "foo", "handle": 5}}, {"chain": {"family": "inet", "table": "foo", "name": "bar", "handle": 1}}, {"rule": {"family": "inet", "table": "foo", "chain": "bar", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "protocol"}}, "right": "ip"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "inet", "table": "foo", "chain": "bar", "handle": 3, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "protocol"}}, "right": "ip6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "inet", "table": "foo", "chain": "bar", "handle": 4, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ether", "field": "type"}}, "right": "ip"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "inet", "table": "foo", "chain": "bar", "handle": 5, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ether", "field": "type"}}, "right": "ip6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "inet", "table": "foo", "chain": "bar", "handle": 6, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "nfproto"}}, "right": "ipv4"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}, {"rule": {"family": "inet", "table": "foo", "chain": "bar", "handle": 7, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "nfproto"}}, "right": "ipv6"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 67}}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_nat.json-nft b/tests/shell/testcases/optimizations/dumps/merge_nat.json-nft
new file mode 100644
index 00000000..675ad48e
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_nat.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "test1", "handle": 2}}, {"chain": {"family": "ip", "table": "test1", "name": "y", "handle": 1}}, {"rule": {"family": "ip", "table": "test1", "chain": "y", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "oif"}}, "right": "lo"}}, {"accept": null}]}}, {"rule": {"family": "ip", "table": "test1", "chain": "y", "handle": 4, "expr": [{"dnat": {"addr": {"map": {"key": {"payload": {"protocol": "ip", "field": "saddr"}}, "data": {"set": [["4.4.4.4", "1.1.1.1"], ["5.5.5.5", "2.2.2.2"]]}}}}}]}}, {"table": {"family": "ip", "name": "test2", "handle": 4}}, {"chain": {"family": "ip", "table": "test2", "name": "y", "handle": 1}}, {"rule": {"family": "ip", "table": "test2", "chain": "y", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "oif"}}, "right": "lo"}}, {"accept": null}]}}, {"rule": {"family": "ip", "table": "test2", "chain": "y", "handle": 4, "expr": [{"dnat": {"family": "ip", "addr": {"map": {"key": {"payload": {"protocol": "tcp", "field": "dport"}}, "data": {"set": [[80, {"concat": ["1.1.1.1", 8001]}], [81, {"concat": ["2.2.2.2", 9001]}]]}}}}}]}}, {"rule": {"family": "ip", "table": "test2", "chain": "y", "handle": 6, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ip", "field": "saddr"}}, "right": {"set": [{"prefix": {"addr": "10.141.11.0", "len": 24}}, {"prefix": {"addr": "10.141.13.0", "len": 24}}]}}}, {"masquerade": null}]}}, {"table": {"family": "ip", "name": "test4", "handle": 6}}, {"chain": {"family": "ip", "table": "test4", "name": "y", "handle": 1}}, {"rule": {"family": "ip", "table": "test4", "chain": "y", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "oif"}}, "right": "lo"}}, {"accept": null}]}}, {"rule": {"family": "ip", "table": "test4", "chain": "y", "handle": 4, "expr": [{"dnat": {"family": "ip", "addr": {"map": {"key": {"concat": [{"payload": {"protocol": "ip", "field": "daddr"}}, {"payload": {"protocol": "tcp", "field": "dport"}}]}, "data": {"set": [[{"concat": ["1.1.1.1", 80]}, {"concat": ["4.4.4.4", 8000]}], [{"concat": ["2.2.2.2", 81]}, {"concat": ["3.3.3.3", 9000]}]]}}}}}]}}, {"rule": {"family": "ip", "table": "test4", "chain": "y", "handle": 6, "expr": [{"redirect": {"port": {"map": {"key": {"payload": {"protocol": "tcp", "field": "dport"}}, "data": {"set": [[83, 8083], [84, 8084]]}}}}}]}}, {"rule": {"family": "ip", "table": "test4", "chain": "y", "handle": 7, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 85}}, {"redirect": null}]}}, {"table": {"family": "inet", "name": "nat", "handle": 8}}, {"chain": {"family": "inet", "table": "nat", "name": "prerouting", "handle": 1}}, {"chain": {"family": "inet", "table": "nat", "name": "postrouting", "handle": 2}}, {"rule": {"family": "inet", "table": "nat", "chain": "prerouting", "handle": 3, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "oif"}}, "right": "lo"}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "nat", "chain": "prerouting", "handle": 5, "expr": [{"dnat": {"family": "ip", "addr": {"map": {"key": {"concat": [{"meta": {"key": "iifname"}}, {"payload": {"protocol": "ip", "field": "daddr"}}, {"payload": {"protocol": "tcp", "field": "dport"}}]}, "data": {"set": [[{"concat": ["enp2s0", "72.2.3.70", 80]}, {"concat": ["10.1.1.52", 80]}], [{"concat": ["enp2s0", "72.2.3.66", 53122]}, {"concat": ["10.1.1.10", 22]}], [{"concat": ["enp2s0", "72.2.3.66", 443]}, {"concat": ["10.1.1.52", 443]}]]}}}}}]}}, {"rule": {"family": "inet", "table": "nat", "chain": "postrouting", "handle": 6, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "oif"}}, "right": "lo"}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "nat", "chain": "postrouting", "handle": 8, "expr": [{"snat": {"family": "ip", "addr": {"map": {"key": {"payload": {"protocol": "ip", "field": "daddr"}}, "data": {"set": [["72.2.3.66", "10.2.2.2"], ["72.2.3.67", "10.2.3.3"]]}}}}}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_nat_concat.json-nft b/tests/shell/testcases/optimizations/dumps/merge_nat_concat.json-nft
new file mode 100644
index 00000000..4edbb84e
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_nat_concat.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "test3", "handle": 2}}, {"chain": {"family": "ip", "table": "test3", "name": "y", "handle": 1}}, {"rule": {"family": "ip", "table": "test3", "chain": "y", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "oif"}}, "right": "lo"}}, {"accept": null}]}}, {"rule": {"family": "ip", "table": "test3", "chain": "y", "handle": 4, "expr": [{"snat": {"addr": {"map": {"key": {"concat": [{"payload": {"protocol": "ip", "field": "saddr"}}, {"payload": {"protocol": "tcp", "field": "sport"}}]}, "data": {"set": [[{"concat": ["1.1.1.1", {"range": [1024, 65535]}]}, "3.3.3.3"], [{"concat": ["2.2.2.2", {"range": [1024, 65535]}]}, "4.4.4.4"]]}}}}}]}}, {"rule": {"family": "ip", "table": "test3", "chain": "y", "handle": 6, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "oifname"}}, "right": "enp2s0"}}, {"snat": {"family": "ip", "addr": {"map": {"key": {"payload": {"protocol": "ip", "field": "saddr"}}, "data": {"set": [[{"prefix": {"addr": "10.1.1.0", "len": 24}}, {"range": ["72.2.3.66", "72.2.3.78"]}]]}}}}}]}}, {"rule": {"family": "ip", "table": "test3", "chain": "y", "handle": 8, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": {"set": [8888, 9999]}}}, {"redirect": null}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_reject.json-nft b/tests/shell/testcases/optimizations/dumps/merge_reject.json-nft
new file mode 100644
index 00000000..f1fe106b
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_reject.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "x", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "y", "handle": 1}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 2, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ip", "field": "daddr"}}, "right": "172.30.33.70"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 3306}}, {"counter": {"packets": 0, "bytes": 0}}, {"drop": null}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 4, "expr": [{"match": {"op": "==", "left": {"concat": [{"meta": {"key": "l4proto"}}, {"payload": {"protocol": "ip", "field": "daddr"}}, {"payload": {"protocol": "tcp", "field": "dport"}}]}, "right": {"set": [{"concat": ["tcp", "172.30.238.117", 8080]}, {"concat": ["tcp", "172.30.33.71", 3306]}, {"concat": ["tcp", "172.30.254.251", 3306]}]}}}, {"counter": {"packets": 0, "bytes": 0}}, {"reject": {"type": "icmp", "expr": "port-unreachable"}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 5, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ip", "field": "daddr"}}, "right": "172.30.254.252"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 3306}}, {"counter": {"packets": 0, "bytes": 0}}, {"reject": {"type": "tcp reset"}}]}}, {"table": {"family": "ip6", "name": "x", "handle": 4}}, {"chain": {"family": "ip6", "table": "x", "name": "y", "handle": 1}}, {"rule": {"family": "ip6", "table": "x", "chain": "y", "handle": 3, "expr": [{"match": {"op": "==", "left": {"concat": [{"meta": {"key": "l4proto"}}, {"payload": {"protocol": "ip6", "field": "daddr"}}, {"payload": {"protocol": "tcp", "field": "dport"}}]}, "right": {"set": [{"concat": ["tcp", "aaaa::3", 8080]}, {"concat": ["tcp", "aaaa::2", 3306]}, {"concat": ["tcp", "aaaa::4", 3306]}]}}}, {"counter": {"packets": 0, "bytes": 0}}, {"reject": {"type": "icmpv6", "expr": "port-unreachable"}}]}}, {"rule": {"family": "ip6", "table": "x", "chain": "y", "handle": 4, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ip6", "field": "daddr"}}, "right": "aaaa::5"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 3306}}, {"counter": {"packets": 0, "bytes": 0}}, {"reject": {"type": "tcp reset"}}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_stmts.json-nft b/tests/shell/testcases/optimizations/dumps/merge_stmts.json-nft
new file mode 100644
index 00000000..d369f49a
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_stmts.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "x", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "y", "handle": 1}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 3, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ip", "field": "daddr"}}, "right": {"set": ["192.168.0.1", "192.168.0.2", "192.168.0.3"]}}}, {"counter": {"packets": 0, "bytes": 0}}, {"accept": null}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_stmts_concat.json-nft b/tests/shell/testcases/optimizations/dumps/merge_stmts_concat.json-nft
new file mode 100644
index 00000000..2e3c5712
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_stmts_concat.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "x", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "y", "handle": 1}}, {"chain": {"family": "ip", "table": "x", "name": "c1", "handle": 21}}, {"chain": {"family": "ip", "table": "x", "name": "c2", "handle": 22}}, {"chain": {"family": "ip", "table": "x", "name": "c3", "handle": 23}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 3, "expr": [{"match": {"op": "==", "left": {"concat": [{"meta": {"key": "iifname"}}, {"payload": {"protocol": "ip", "field": "saddr"}}, {"payload": {"protocol": "ip", "field": "daddr"}}]}, "right": {"set": [{"concat": ["eth1", "1.1.1.1", "2.2.2.3"]}, {"concat": ["eth1", "1.1.1.2", "2.2.2.4"]}, {"concat": ["eth1", "1.1.1.2", {"prefix": {"addr": "2.2.3.0", "len": 24}}]}, {"concat": ["eth1", "1.1.1.2", {"range": ["2.2.4.0", "2.2.4.10"]}]}, {"concat": ["eth2", "1.1.1.3", "2.2.2.5"]}]}}}, {"accept": null}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 5, "expr": [{"match": {"op": "==", "left": {"concat": [{"payload": {"protocol": "ip", "field": "protocol"}}, {"payload": {"protocol": "th", "field": "dport"}}]}, "right": {"set": [{"concat": ["tcp", 22]}, {"concat": ["udp", 67]}]}}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "c1", "handle": 25, "expr": [{"match": {"op": "==", "left": {"concat": [{"payload": {"protocol": "udp", "field": "dport"}}, {"meta": {"key": "iifname"}}]}, "right": {"set": [{"concat": [51820, "foo"]}, {"concat": [514, "bar"]}, {"concat": [67, "bar"]}]}}}, {"accept": null}]}}, {"rule": {"family": "ip", "table": "x", "chain": "c2", "handle": 27, "expr": [{"match": {"op": "==", "left": {"concat": [{"payload": {"protocol": "udp", "field": "dport"}}, {"meta": {"key": "iifname"}}]}, "right": {"set": [{"concat": [100, "foo"]}, {"concat": [51820, "foo"]}, {"concat": [514, "bar"]}, {"concat": [67, "bar"]}]}}}, {"accept": null}]}}, {"rule": {"family": "ip", "table": "x", "chain": "c3", "handle": 29, "expr": [{"match": {"op": "==", "left": {"concat": [{"payload": {"protocol": "udp", "field": "dport"}}, {"meta": {"key": "iifname"}}]}, "right": {"set": [{"concat": [100, "foo"]}, {"concat": [51820, "foo"]}, {"concat": [514, "bar"]}, {"concat": [67, "bar"]}, {"concat": [100, "test"]}, {"concat": [51820, "test"]}]}}}, {"accept": null}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_stmts_concat_vmap.json-nft b/tests/shell/testcases/optimizations/dumps/merge_stmts_concat_vmap.json-nft
new file mode 100644
index 00000000..5c608daa
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_stmts_concat_vmap.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "x", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "x", "handle": 1}}, {"chain": {"family": "ip", "table": "x", "name": "y", "handle": 2}}, {"rule": {"family": "ip", "table": "x", "chain": "x", "handle": 4, "expr": [{"vmap": {"key": {"concat": [{"meta": {"key": "pkttype"}}, {"payload": {"protocol": "udp", "field": "dport"}}]}, "data": {"set": [[{"concat": ["broadcast", 547]}, {"accept": null}], [{"concat": ["broadcast", 67]}, {"accept": null}], [{"concat": ["multicast", 1900]}, {"drop": null}]]}}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 6, "expr": [{"vmap": {"key": {"concat": [{"payload": {"protocol": "ip", "field": "saddr"}}, {"payload": {"protocol": "ip", "field": "daddr"}}]}, "data": {"set": [[{"concat": ["1.1.1.1", "2.2.2.2"]}, {"accept": null}], [{"concat": ["2.2.2.2", "3.3.3.3"]}, {"drop": null}], [{"concat": ["4.4.4.4", "5.5.5.5"]}, {"accept": null}]]}}}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.json-nft b/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.json-nft
new file mode 100644
index 00000000..80cbf232
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "x", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "y", "handle": 1}}, {"chain": {"family": "ip", "table": "x", "name": "z", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "w", "handle": 3}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 5, "expr": [{"vmap": {"key": {"ct": {"key": "state"}}, "data": {"set": [["invalid", {"drop": null}], ["established", {"accept": null}], ["related", {"accept": null}]]}}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "z", "handle": 7, "expr": [{"vmap": {"key": {"payload": {"protocol": "tcp", "field": "dport"}}, "data": {"set": [[1, {"accept": null}], [{"range": [2, 3]}, {"drop": null}], [4, {"accept": null}]]}}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "w", "handle": 9, "expr": [{"vmap": {"key": {"payload": {"protocol": "ip", "field": "saddr"}}, "data": {"set": [[{"elem": {"val": "1.1.1.1", "counter": {"packets": 0, "bytes": 0}}}, {"accept": null}], [{"elem": {"val": "1.1.1.2", "counter": {"packets": 0, "bytes": 0}}}, {"drop": null}]]}}}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_vmap_raw.json-nft b/tests/shell/testcases/optimizations/dumps/merge_vmap_raw.json-nft
new file mode 100644
index 00000000..6eb241c3
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_vmap_raw.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "inet", "name": "x", "handle": 2}}, {"chain": {"family": "inet", "table": "x", "name": "nat_dns_dnstc", "handle": 1}}, {"chain": {"family": "inet", "table": "x", "name": "nat_dns_this_5301", "handle": 2}}, {"chain": {"family": "inet", "table": "x", "name": "nat_dns_saturn_5301", "handle": 3}}, {"chain": {"family": "inet", "table": "x", "name": "nat_dns_saturn_5302", "handle": 4}}, {"chain": {"family": "inet", "table": "x", "name": "nat_dns_saturn_5303", "handle": 5}}, {"chain": {"family": "inet", "table": "x", "name": "nat_dns_acme", "handle": 6}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_dnstc", "handle": 7, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "l4proto"}}, "right": "udp"}}, {"redirect": {"port": 5300}}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_dnstc", "handle": 8, "expr": [{"drop": null}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_this_5301", "handle": 9, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "l4proto"}}, "right": "udp"}}, {"redirect": {"port": 5301}}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_this_5301", "handle": 10, "expr": [{"drop": null}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_saturn_5301", "handle": 11, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "nfproto"}}, "right": "ipv4"}}, {"match": {"op": "==", "left": {"meta": {"key": "l4proto"}}, "right": "udp"}}, {"dnat": {"family": "ip", "addr": "240.0.1.2", "port": 5301}}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_saturn_5301", "handle": 12, "expr": [{"drop": null}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_saturn_5302", "handle": 13, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "nfproto"}}, "right": "ipv4"}}, {"match": {"op": "==", "left": {"meta": {"key": "l4proto"}}, "right": "udp"}}, {"dnat": {"family": "ip", "addr": "240.0.1.2", "port": 5302}}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_saturn_5302", "handle": 14, "expr": [{"drop": null}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_saturn_5303", "handle": 15, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "nfproto"}}, "right": "ipv4"}}, {"match": {"op": "==", "left": {"meta": {"key": "l4proto"}}, "right": "udp"}}, {"dnat": {"family": "ip", "addr": "240.0.1.2", "port": 5303}}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_saturn_5303", "handle": 16, "expr": [{"drop": null}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_acme", "handle": 18, "expr": [{"vmap": {"key": {"concat": [{"payload": {"protocol": "udp", "field": "length"}}, {"payload": {"base": "th", "offset": 160, "len": 128}}]}, "data": {"set": [[{"concat": [{"range": [47, 63]}, "0xe373135363130333131303735353203"]}, {"goto": {"target": "nat_dns_dnstc"}}], [{"concat": [{"range": [62, 78]}, "0xe31393032383939353831343037320e"]}, {"goto": {"target": "nat_dns_this_5301"}}], [{"concat": [{"range": [62, 78]}, "0xe31363436323733373931323934300e"]}, {"goto": {"target": "nat_dns_saturn_5301"}}], [{"concat": [{"range": [62, 78]}, "0xe32393535373539353636383732310e"]}, {"goto": {"target": "nat_dns_saturn_5302"}}], [{"concat": [{"range": [62, 78]}, "0xe38353439353637323038363633390e"]}, {"goto": {"target": "nat_dns_saturn_5303"}}]]}}}]}}, {"rule": {"family": "inet", "table": "x", "chain": "nat_dns_acme", "handle": 19, "expr": [{"drop": null}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/merge_vmaps.json-nft b/tests/shell/testcases/optimizations/dumps/merge_vmaps.json-nft
new file mode 100644
index 00000000..9f65daec
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/merge_vmaps.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "x", "handle": 2}}, {"set": {"family": "ip", "name": "s", "table": "x", "type": "ipv4_addr", "handle": 4, "size": 65535, "flags": ["dynamic"]}}, {"chain": {"family": "ip", "table": "x", "name": "filter_in_tcp", "handle": 1}}, {"chain": {"family": "ip", "table": "x", "name": "filter_in_udp", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "y", "handle": 3}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 5, "expr": [{"set": {"op": "update", "elem": {"payload": {"protocol": "ip", "field": "saddr"}}, "set": "@s", "stmt": [{"limit": {"rate": 12, "burst": 30, "per": "minute"}}]}}, {"accept": null}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 7, "expr": [{"vmap": {"key": {"payload": {"protocol": "tcp", "field": "dport"}}, "data": {"set": [[80, {"accept": null}], [81, {"accept": null}], [443, {"accept": null}], [{"range": [8000, 8100]}, {"accept": null}], [{"range": [24000, 25000]}, {"accept": null}]]}}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 9, "expr": [{"vmap": {"key": {"meta": {"key": "l4proto"}}, "data": {"set": [["tcp", {"goto": {"target": "filter_in_tcp"}}], ["udp", {"goto": {"target": "filter_in_udp"}}]]}}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 10, "expr": [{"log": null}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/not_mergeable.json-nft b/tests/shell/testcases/optimizations/dumps/not_mergeable.json-nft
new file mode 100644
index 00000000..65584efd
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/not_mergeable.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "x", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "t1", "handle": 1}}, {"chain": {"family": "ip", "table": "x", "name": "t2", "handle": 2}}, {"chain": {"family": "ip", "table": "x", "name": "t3", "handle": 3}}, {"chain": {"family": "ip", "table": "x", "name": "t4", "handle": 4}}, {"chain": {"family": "ip", "table": "x", "name": "y", "handle": 5}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 6, "expr": [{"counter": {"packets": 0, "bytes": 0}}, {"jump": {"target": "t1"}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 7, "expr": [{"counter": {"packets": 0, "bytes": 0}}, {"jump": {"target": "t2"}}]}}, {"rule": {"family": "ip", "table": "x", "chain": "y", "handle": 9, "expr": [{"vmap": {"key": {"payload": {"protocol": "ip", "field": "version"}}, "data": {"set": [[4, {"jump": {"target": "t3"}}], [6, {"jump": {"target": "t4"}}]]}}}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/ruleset.json-nft b/tests/shell/testcases/optimizations/dumps/ruleset.json-nft
new file mode 100644
index 00000000..0048e6b1
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/ruleset.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/single_anon_set_expr.json-nft b/tests/shell/testcases/optimizations/dumps/single_anon_set_expr.json-nft
new file mode 100644
index 00000000..ca613087
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/single_anon_set_expr.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "ip", "name": "test", "handle": 1}}, {"chain": {"family": "ip", "table": "test", "name": "test", "handle": 1}}, {"rule": {"family": "ip", "table": "test", "chain": "test", "handle": 3, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "mark"}}, "right": {"set": [{"elem": {"val": 10, "counter": {"packets": 0, "bytes": 0}}}]}}}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/skip_merge.json-nft b/tests/shell/testcases/optimizations/dumps/skip_merge.json-nft
new file mode 100644
index 00000000..e1b2bd05
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/skip_merge.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "inet", "name": "filter", "handle": 2}}, {"set": {"family": "inet", "name": "udp_accepted", "table": "filter", "type": "inet_service", "handle": 3, "elem": [500, 4500]}}, {"set": {"family": "inet", "name": "tcp_accepted", "table": "filter", "type": "inet_service", "handle": 4, "elem": [80, 443]}}, {"chain": {"family": "inet", "table": "filter", "name": "udp_input", "handle": 1}}, {"chain": {"family": "inet", "table": "filter", "name": "tcp_input", "handle": 2}}, {"rule": {"family": "inet", "table": "filter", "chain": "udp_input", "handle": 5, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": {"range": [1, 128]}}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "filter", "chain": "udp_input", "handle": 6, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": "@udp_accepted"}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "filter", "chain": "udp_input", "handle": 7, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "udp", "field": "dport"}}, "right": 53}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "filter", "chain": "tcp_input", "handle": 9, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": {"set": [{"range": [1, 128]}, {"range": [8888, 9999]}]}}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "filter", "chain": "tcp_input", "handle": 10, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": "@tcp_accepted"}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "filter", "chain": "tcp_input", "handle": 11, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": {"range": [1024, 65535]}}}, {"accept": null}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/skip_non_eq.json-nft b/tests/shell/testcases/optimizations/dumps/skip_non_eq.json-nft
new file mode 100644
index 00000000..df489148
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/skip_non_eq.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "inet", "name": "x", "handle": 2}}, {"chain": {"family": "inet", "table": "x", "name": "y", "handle": 1}}, {"rule": {"family": "inet", "table": "x", "chain": "y", "handle": 2, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "iifname"}}, "right": "eth0"}}, {"match": {"op": "!=", "left": {"meta": {"key": "oifname"}}, "right": "eth0"}}, {"counter": {"packets": 0, "bytes": 0}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "x", "chain": "y", "handle": 3, "expr": [{"match": {"op": "==", "left": {"meta": {"key": "iifname"}}, "right": "eth0"}}, {"match": {"op": "==", "left": {"meta": {"key": "oifname"}}, "right": "eth0"}}, {"counter": {"packets": 0, "bytes": 0}}, {"accept": null}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/skip_unsupported.json-nft b/tests/shell/testcases/optimizations/dumps/skip_unsupported.json-nft
new file mode 100644
index 00000000..41872871
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/skip_unsupported.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}, {"table": {"family": "inet", "name": "x", "handle": 2}}, {"set": {"family": "inet", "name": "GEOIP_CC_wan-lan_120", "table": "x", "type": "ipv4_addr", "handle": 2, "flags": ["interval"], "elem": [{"prefix": {"addr": "1.32.128.0", "len": 18}}, {"range": ["1.32.200.0", "1.32.204.128"]}, {"prefix": {"addr": "1.32.207.0", "len": 24}}, {"range": ["1.32.216.118", "1.32.216.255"]}, {"range": ["1.32.219.0", "1.32.222.255"]}, {"prefix": {"addr": "1.32.226.0", "len": 23}}, {"prefix": {"addr": "1.32.231.0", "len": 24}}, {"prefix": {"addr": "1.32.233.0", "len": 24}}, {"prefix": {"addr": "1.32.238.0", "len": 23}}, {"prefix": {"addr": "1.32.240.0", "len": 24}}, {"prefix": {"addr": "223.223.220.0", "len": 22}}, {"prefix": {"addr": "223.255.254.0", "len": 24}}]}}, {"chain": {"family": "inet", "table": "x", "name": "y", "handle": 1}}, {"rule": {"family": "inet", "table": "x", "chain": "y", "handle": 3, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ip", "field": "saddr"}}, "right": "1.2.3.4"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 80}}, {"mangle": {"key": {"meta": {"key": "mark"}}, "value": 10}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "x", "chain": "y", "handle": 4, "expr": [{"match": {"op": "==", "left": {"payload": {"protocol": "ip", "field": "saddr"}}, "right": "1.2.3.4"}}, {"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": 81}}, {"mangle": {"key": {"meta": {"key": "mark"}}, "value": 11}}, {"accept": null}]}}, {"rule": {"family": "inet", "table": "x", "chain": "y", "handle": 6, "expr": [{"match": {"op": "==", "left": {"concat": [{"payload": {"protocol": "ip", "field": "saddr"}}, {"payload": {"protocol": "tcp", "field": "dport"}}]}, "right": {"set": [{"concat": ["1.2.3.5", 81]}, {"concat": ["1.2.3.5", 82]}]}}}, {"accept": null}]}}]}
diff --git a/tests/shell/testcases/optimizations/dumps/variables.json-nft b/tests/shell/testcases/optimizations/dumps/variables.json-nft
new file mode 100644
index 00000000..0048e6b1
--- /dev/null
+++ b/tests/shell/testcases/optimizations/dumps/variables.json-nft
@@ -0,0 +1 @@
+{"nftables": [{"metainfo": {"version": "VERSION", "release_name": "RELEASE_NAME", "json_schema_version": 1}}]}