From 9be404a153bc9525d52afabed622843717c37851 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 7 Feb 2023 10:53:41 +0100 Subject: optimize: ignore existing nat mapping User might be already using a nat mapping in their ruleset, use the unsupported statement when collecting statements in this case. # nft -c -o -f ruleset.nft nft: optimize.c:443: rule_build_stmt_matrix_stmts: Assertion `k >= 0' failed. Aborted The -o/--optimize feature only cares about linear rulesets at this stage, but do not hit assert() in this case. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1656 Fixes: 0a6dbfce6dc3 ("optimize: merge nat rules with same selectors into map") Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/optimizations/dumps/merge_nat.nft | 1 + 1 file changed, 1 insertion(+) (limited to 'tests/shell/testcases/optimizations/dumps') diff --git a/tests/shell/testcases/optimizations/dumps/merge_nat.nft b/tests/shell/testcases/optimizations/dumps/merge_nat.nft index 32423b22..96e38ccd 100644 --- a/tests/shell/testcases/optimizations/dumps/merge_nat.nft +++ b/tests/shell/testcases/optimizations/dumps/merge_nat.nft @@ -14,6 +14,7 @@ table ip test3 { chain y { oif "lo" accept snat to ip saddr . tcp sport map { 1.1.1.1 . 1024-65535 : 3.3.3.3, 2.2.2.2 . 1024-65535 : 4.4.4.4 } + oifname "enp2s0" snat ip to ip saddr map { 10.1.1.0/24 : 72.2.3.66-72.2.3.78 } } } table ip test4 { -- cgit v1.2.3