diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-02-07 10:53:41 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-02-07 11:39:16 +0100 |
| commit | 9be404a153bc9525d52afabed622843717c37851 (patch) | |
| tree | dcae66af68d20766a9508186c97b594557366323 /tests/shell/testcases/optimizations/dumps | |
| parent | 27c753e4a8d4744f479345e3f5e34cafef751602 (diff) | |
optimize: ignore existing nat mapping
User might be already using a nat mapping in their ruleset, use the
unsupported statement when collecting statements in this case.
# nft -c -o -f ruleset.nft
nft: optimize.c:443: rule_build_stmt_matrix_stmts: Assertion `k >= 0' failed.
Aborted
The -o/--optimize feature only cares about linear rulesets at this
stage, but do not hit assert() in this case.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1656
Fixes: 0a6dbfce6dc3 ("optimize: merge nat rules with same selectors into map")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/shell/testcases/optimizations/dumps')
| -rw-r--r-- | tests/shell/testcases/optimizations/dumps/merge_nat.nft | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/tests/shell/testcases/optimizations/dumps/merge_nat.nft b/tests/shell/testcases/optimizations/dumps/merge_nat.nft index 32423b22..96e38ccd 100644 --- a/tests/shell/testcases/optimizations/dumps/merge_nat.nft +++ b/tests/shell/testcases/optimizations/dumps/merge_nat.nft @@ -14,6 +14,7 @@ table ip test3 { chain y { oif "lo" accept snat to ip saddr . tcp sport map { 1.1.1.1 . 1024-65535 : 3.3.3.3, 2.2.2.2 . 1024-65535 : 4.4.4.4 } + oifname "enp2s0" snat ip to ip saddr map { 10.1.1.0/24 : 72.2.3.66-72.2.3.78 } } } table ip test4 { |