Included bogon asserts:
src/netlink_linearize.c:1305: netlink_gen_nat_stmt: Assertion `stmt->nat.proto == NULL' failed.
The comment right above the assertion says:
nat_stmt evaluation step doesn't allow
STMT_NAT_F_CONCAT && stmt->nat.proto.
... except it does allow it. Disable this.
Fixes: c68314dd4263 ("src: infer NAT mapping with concatenation from set")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
src/evaluate.c | 4 ++++
tests/shell/testcases/bogons/nat_map_and_protocol_assert | 5 +++++
2 files changed, 9 insertions(+)
create mode 100644 tests/shell/testcases/bogons/nat_map_and_protocol_assert
diff --git a/src/evaluate.c b/src/evaluate.c
index 95b9b3d547d9..3a453d010538 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -4196,6 +4196,10 @@ static int stmt_evaluate_nat_map(struct eval_ctx *ctx, struct stmt *stmt)
int addr_type;
int err;
+ if (stmt->nat.proto)
+ return stmt_binary_error(ctx, stmt, stmt->nat.proto,
+ "nat map and protocol are mutually exclusive");
+
if (stmt->nat.family == NFPROTO_INET)
expr_family_infer(pctx, stmt->nat.addr, &stmt->nat.family);
diff --git a/tests/shell/testcases/bogons/nat_map_and_protocol_assert b/tests/shell/testcases/bogons/nat_map_and_protocol_assert
new file mode 100644
index 000000000000..67f2ae873cd1
--- /dev/null
+++ b/tests/shell/testcases/bogons/nat_map_and_protocol_assert
@@ -0,0 +1,5 @@
+table t {
+ chain y {
+ snat to ip saddr . tcp sport map { 1.1.1.1 . 1 : 1.1.1.2 . 1 } : 6
+ }
+}
--
2.48.1
