Re: Optimization works only on specific syntax? (was [ANNOUNCE] nftables 1.0.5 release)

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Mon, Aug 22, 2022 at 08:53:39PM +0530, Amish wrote:
> On 15/08/22 06:30, Amish wrote:
> > On 10/08/22 01:24, Pablo Neira Ayuso wrote:
> > > - Fixes for the -o/--optimize, run this --optimize option to
> > > automagically
> > >    compact your ruleset using sets, maps and concatenations, eg.
> > > 
> > >       # cat ruleset.nft
> > >       table ip x {
> > >              chain y {
> > >                      type nat hook postrouting priority srcnat;
> > > policy drop;
> > >                      ip saddr 1.1.1.1 tcp dport 8000 snat to 4.4.4.4:80
> > >                      ip saddr 2.2.2.2 tcp dport 8001 snat to 5.5.5.5:90
> > >              }
> > >       }
> > > 
> > >       # nft -o -c -f ruleset.nft
> > >       Merging:
> > >       ruleset.nft:4:3-52:                ip saddr 1.1.1.1 tcp dport
> > > 8000 snat to 4.4.4.4:80
> > >       ruleset.nft:5:3-52:                ip saddr 2.2.2.2 tcp dport
> > > 8001 snat to 5.5.5.5:90
> > >       into:
> > >              snat to ip saddr . tcp dport map { 1.1.1.1 . 8000 :
> > > 4.4.4.4 . 80, 2.2.2.2 . 8001 : 5.5.5.5 . 90 }
> > 
> > This optimization seems to be working only on specific syntax.
> > 
> > If I mention same thing with alternative syntax, there is no suggestion
> > to optimize.
> > 
> > # cat ruleset.nft
> > add table ip x
> > add chain ip x y { type nat hook postrouting priority srcnat; policy
> > drop; }
> > add rule ip x y ip saddr 1.1.1.1 tcp dport 8000 snat to 4.4.4.4:80
> > add rule ip x y ip saddr 2.2.2.2 tcp dport 8001 snat to 5.5.5.5:90
> > 
> > # nft -o -c -f ruleset.nft
> > <no output with exit code 0>
> > 
> > Which means that no optimization is suggested but check passed
> > successfully.
> > 
> > I was expecting that it will reply with:
> > 
> > Merging:
> >  ...
> > into:
> >     add rule ip x y snat to ip saddr . tcp dport map { 1.1.1.1 . 8000 :
> > 4.4.4.4 . 80, 2.2.2.2 . 8001 : 5.5.5.5 . 90 }
> > 
> > OR if it can not translate to exact syntax then atleast it should
> > mention that there is possibility to optimize the rules.
> > 
> > Is there any reason? Am I doing something wrong?

The plain syntax is not supported yet, that's all, it needs a bit of work.