From 9be404a153bc9525d52afabed622843717c37851 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 7 Feb 2023 10:53:41 +0100 Subject: optimize: ignore existing nat mapping User might be already using a nat mapping in their ruleset, use the unsupported statement when collecting statements in this case. # nft -c -o -f ruleset.nft nft: optimize.c:443: rule_build_stmt_matrix_stmts: Assertion `k >= 0' failed. Aborted The -o/--optimize feature only cares about linear rulesets at this stage, but do not hit assert() in this case. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1656 Fixes: 0a6dbfce6dc3 ("optimize: merge nat rules with same selectors into map") Signed-off-by: Pablo Neira Ayuso --- src/optimize.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/optimize.c') diff --git a/src/optimize.c b/src/optimize.c index ff4f2627..d60aa8f2 100644 --- a/src/optimize.c +++ b/src/optimize.c @@ -370,6 +370,13 @@ static int rule_collect_stmts(struct optimize_ctx *ctx, struct rule *rule) clone->log.prefix = expr_get(stmt->log.prefix); break; case STMT_NAT: + if ((stmt->nat.addr && + stmt->nat.addr->etype == EXPR_MAP) || + (stmt->nat.proto && + stmt->nat.proto->etype == EXPR_MAP)) { + clone->ops = &unsupported_stmt_ops; + break; + } clone->nat.type = stmt->nat.type; clone->nat.family = stmt->nat.family; if (stmt->nat.addr) -- cgit v1.2.3