[nft PATCH] dynset: avoid errouneous assert with ipv6 concat data

[nft PATCH] dynset: avoid errouneous assert with ipv6 concat data

[Son Dinh]

Fix assert bug of map dynset having ipv6 concat data

 nft add rule ip6 table-test chain-1 update @map-X { ip6 saddr : 1000::1 . 5001 }
 nft: src/netlink_linearize.c:873: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed.
 Aborted (core dumped)

The current code allocates upto 4 registers for map dynset data, but ipv6 concat
data of a dynset requires more than 4 registers, resulting in the assert in
netlink_gen_expr when generating netlink info for the dynset data.

Signed-off-by: Son Dinh <dinhtrason@gmail.com>
---
 src/netlink_linearize.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git src/netlink_linearize.c src/netlink_linearize.c
index 6204d8fd..11b4bc2d 100644
--- src/netlink_linearize.c
+++ src/netlink_linearize.c
@@ -1588,15 +1588,20 @@ static void netlink_gen_map_stmt(struct netlink_linearize_ctx *ctx,
 	struct nftnl_expr *nle;
 	int num_stmts = 0;
 	struct stmt *this;
+	int regspace = 0;
+	struct expr *expr_data = stmt->map.data;
 
 	sreg_key = get_register(ctx, stmt->map.key->key);
 	netlink_gen_expr(ctx, stmt->map.key->key, sreg_key);
 
-	sreg_data = get_register(ctx, stmt->map.data);
-	netlink_gen_expr(ctx, stmt->map.data, sreg_data);
+	/* Adjust ctx->reg_low to the real size of stmt->map.data */
+	regspace = netlink_register_space(expr_data->map->len);
+	sreg_data = ctx->reg_low;
+	ctx->reg_low += regspace;
+	netlink_gen_expr(ctx, expr_data, sreg_data);
 
+	ctx->reg_low -= regspace;
 	release_register(ctx, stmt->map.key->key);
-	release_register(ctx, stmt->map.data);
 
 	nle = alloc_nft_expr("dynset");
 	netlink_put_register(nle, NFTNL_EXPR_DYNSET_SREG_KEY, sreg_key);
-- 
2.44.0.windows.1

Re: [nft PATCH] dynset: avoid errouneous assert with ipv6 concat data

[Florian Westphal]

Son Dinh <dinhtrason@gmail.com> wrote:
> Fix assert bug of map dynset having ipv6 concat data
> 
>  nft add rule ip6 table-test chain-1 update @map-X { ip6 saddr : 1000::1 . 5001 }
>  nft: src/netlink_linearize.c:873: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed.
>  Aborted (core dumped)
> 
> The current code allocates upto 4 registers for map dynset data, but ipv6 concat
> data of a dynset requires more than 4 registers, resulting in the assert in
> netlink_gen_expr when generating netlink info for the dynset data.

Could you plese either extend an existing test case or add a new one for
this?

> -	sreg_data = get_register(ctx, stmt->map.data);

This line is wrong, this sould be

   	sreg_data = get_register(ctx, stmt->map.data->key);

Re: [nft PATCH] dynset: avoid errouneous assert with ipv6 concat data

[Son Tra Dinh]

On Mon, 8 Apr 2024 at 03:17, Florian Westphal <fw@strlen.de> wrote:
>
> Could you plese either extend an existing test case or add a new one for
> this?
>

Sure. I'm working on it.

> > -     sreg_data = get_register(ctx, stmt->map.data);
>
> This line is wrong, this sould be
>
>         sreg_data = get_register(ctx, stmt->map.data->key);

You're correct. Fixing the bug with your suggest is much simpler than
mine if getting registers of ipv6 concat data directly with
"get_register(ctx, stmt->map.data->key);" instead of
"get_register(ctx, stmt->map.data)"

[nft PATCH v2] dynset: avoid errouneous assert with ipv6 concat data

[Son Dinh]

Fix assert bug of map dynset having ipv6 concat data

 nft add rule ip6 table-test chain-1 update @map-X { ip6 saddr : 1000::1 . 5001 }
 nft: src/netlink_linearize.c:873: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed.
 Aborted (core dumped)

The current code allocates upto 4 registers for map dynset data, but ipv6 concat
data of a dynset requires more than 4 registers, resulting in the assert in
netlink_gen_expr when generating netlink info for the dynset data.

Signed-off-by: Son Dinh <dinhtrason@gmail.com>
---
 src/netlink_linearize.c            |  6 +++---
 tests/py/ip/sets.t                 |  2 ++
 tests/py/ip/sets.t.payload.inet    | 11 +++++++++++
 tests/py/ip/sets.t.payload.ip      |  8 ++++++++
 tests/py/ip/sets.t.payload.netdev  | 10 ++++++++++
 tests/py/ip6/sets.t                |  3 +++
 tests/py/ip6/sets.t.payload.inet   | 11 +++++++++++
 tests/py/ip6/sets.t.payload.ip6    |  8 ++++++++
 tests/py/ip6/sets.t.payload.netdev | 10 ++++++++++
 tests/py/nft-test.py               |  4 ++++
 10 files changed, 70 insertions(+), 3 deletions(-)

diff --git src/netlink_linearize.c src/netlink_linearize.c
index 6204d8fd..de9e975f 100644
--- src/netlink_linearize.c
+++ src/netlink_linearize.c
@@ -1592,11 +1592,11 @@ static void netlink_gen_map_stmt(struct netlink_linearize_ctx *ctx,
 	sreg_key = get_register(ctx, stmt->map.key->key);
 	netlink_gen_expr(ctx, stmt->map.key->key, sreg_key);
 
-	sreg_data = get_register(ctx, stmt->map.data);
-	netlink_gen_expr(ctx, stmt->map.data, sreg_data);
+	sreg_data = get_register(ctx, stmt->map.data->key);
+	netlink_gen_expr(ctx, stmt->map.data->key, sreg_data);
 
 	release_register(ctx, stmt->map.key->key);
-	release_register(ctx, stmt->map.data);
+	release_register(ctx, stmt->map.data->key);
 
 	nle = alloc_nft_expr("dynset");
 	netlink_put_register(nle, NFTNL_EXPR_DYNSET_SREG_KEY, sreg_key);
diff --git tests/py/ip/sets.t tests/py/ip/sets.t
index 46d9686b..828a1f1f 100644
--- tests/py/ip/sets.t
+++ tests/py/ip/sets.t
@@ -66,3 +66,5 @@ ip saddr @set6 drop;ok
 ip saddr vmap { 1.1.1.1 : drop, * : accept };ok
 meta mark set ip saddr map { 1.1.1.1 : 0x00000001, * : 0x00000002 };ok
 
+!map2 type ipv4_addr . ipv4_addr . inet_service : ipv4_addr . inet_service;ok
+add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 };ok
\ No newline at end of file
diff --git tests/py/ip/sets.t.payload.inet tests/py/ip/sets.t.payload.inet
index fd6517a5..cc04b43d 100644
--- tests/py/ip/sets.t.payload.inet
+++ tests/py/ip/sets.t.payload.inet
@@ -104,3 +104,14 @@ inet
   [ payload load 4b @ network header + 12 => reg 1 ]
   [ lookup reg 1 set __map%d dreg 1 ]
   [ meta set mark with reg 1 ]
+
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+inet test-inet input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+  [ payload load 4b @ network header + 12 => reg 1 ]
+  [ payload load 4b @ network header + 16 => reg 9 ]
+  [ payload load 2b @ transport header + 2 => reg 10 ]
+  [ immediate reg 11 0x0100000a ]
+  [ immediate reg 2 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip/sets.t.payload.ip tests/py/ip/sets.t.payload.ip
index d9cc32b6..f9ee1f98 100644
--- tests/py/ip/sets.t.payload.ip
+++ tests/py/ip/sets.t.payload.ip
@@ -81,3 +81,11 @@ ip test-ip4 input
   [ meta load mark => reg 10 ]
   [ dynset add reg_key 1 set map1 sreg_data 10 ]
 
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+ip test-ip4 input
+  [ payload load 4b @ network header + 12 => reg 1 ]
+  [ payload load 4b @ network header + 16 => reg 9 ]
+  [ payload load 2b @ transport header + 2 => reg 10 ]
+  [ immediate reg 11 0x0100000a ]
+  [ immediate reg 2 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip/sets.t.payload.netdev tests/py/ip/sets.t.payload.netdev
index d41b9e8b..3d0dc79a 100644
--- tests/py/ip/sets.t.payload.netdev
+++ tests/py/ip/sets.t.payload.netdev
@@ -105,3 +105,13 @@ netdev test-netdev ingress
   [ meta load mark => reg 10 ]
   [ dynset add reg_key 1 set map1 sreg_data 10 ]
 
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+netdev test-netdev ingress
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+  [ payload load 4b @ network header + 12 => reg 1 ]
+  [ payload load 4b @ network header + 16 => reg 9 ]
+  [ payload load 2b @ transport header + 2 => reg 10 ]
+  [ immediate reg 11 0x0100000a ]
+  [ immediate reg 2 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip6/sets.t tests/py/ip6/sets.t
index 17fd62f5..cc26bd22 100644
--- tests/py/ip6/sets.t
+++ tests/py/ip6/sets.t
@@ -46,3 +46,6 @@ add @set5 { ip6 saddr . ip6 daddr };ok
 add @map1 { ip6 saddr . ip6 daddr : meta mark };ok
 
 delete @set5 { ip6 saddr . ip6 daddr };ok
+
+!map2 type ipv6_addr . ipv6_addr . inet_service : ipv6_addr . inet_service;ok
+add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 };ok
\ No newline at end of file
diff --git tests/py/ip6/sets.t.payload.inet tests/py/ip6/sets.t.payload.inet
index 2bbd5573..2dbb818a 100644
--- tests/py/ip6/sets.t.payload.inet
+++ tests/py/ip6/sets.t.payload.inet
@@ -47,3 +47,14 @@ inet test-inet input
   [ payload load 16b @ network header + 8 => reg 1 ]
   [ payload load 16b @ network header + 24 => reg 2 ]
   [ dynset delete reg_key 1 set set5 ]
+
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+inet test-inet input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x0000000a ]
+  [ payload load 16b @ network header + 8 => reg 1 ]
+  [ payload load 16b @ network header + 24 => reg 2 ]
+  [ payload load 2b @ transport header + 2 => reg 3 ]
+  [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+  [ immediate reg 21 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/ip6/sets.t.payload.ip6 tests/py/ip6/sets.t.payload.ip6
index c59f7b5c..7234b989 100644
--- tests/py/ip6/sets.t.payload.ip6
+++ tests/py/ip6/sets.t.payload.ip6
@@ -36,3 +36,11 @@ ip6 test-ip6 input
   [ meta load mark => reg 3 ]
   [ dynset add reg_key 1 set map1 sreg_data 3 ]
 
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+ip6 test-ip6 input
+  [ payload load 16b @ network header + 8 => reg 1 ]
+  [ payload load 16b @ network header + 24 => reg 2 ]
+  [ payload load 2b @ transport header + 2 => reg 3 ]
+  [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+  [ immediate reg 21 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/ip6/sets.t.payload.netdev tests/py/ip6/sets.t.payload.netdev
index 1866d26b..2ad0f434 100644
--- tests/py/ip6/sets.t.payload.netdev
+++ tests/py/ip6/sets.t.payload.netdev
@@ -48,3 +48,13 @@ netdev test-netdev ingress
   [ meta load mark => reg 3 ]
   [ dynset add reg_key 1 set map1 sreg_data 3 ]
 
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+netdev test-netdev ingress
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x0000dd86 ]
+  [ payload load 16b @ network header + 8 => reg 1 ]
+  [ payload load 16b @ network header + 24 => reg 2 ]
+  [ payload load 2b @ transport header + 2 => reg 3 ]
+  [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+  [ immediate reg 21 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/nft-test.py tests/py/nft-test.py
index a7d27c25..eafa258e 100755
--- tests/py/nft-test.py
+++ tests/py/nft-test.py
@@ -1162,6 +1162,10 @@ def set_process(set_line, filename, lineno):
         set_data = tokens[i+1]
         i += 2
 
+    while len(tokens) > i and tokens[i] == ".":
+        set_data += " . " + tokens[i+1]
+        i += 2
+
     if parse_typeof and tokens[i] == "mark":
         set_data += " " + tokens[i]
         i += 1;
-- 
2.44.0.windows.1

[nft PATCH v3] dynset: avoid errouneous assert with ipv6 concat data

[Son Dinh]

Fix assert bug of map dynset having ipv6 concat data

 nft add rule ip6 table-test chain-1 update @map-X { ip6 saddr : 1000::1 . 5001 }
 nft: src/netlink_linearize.c:873: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed.
 Aborted (core dumped)

The current code allocates upto 4 registers for map dynset data, but ipv6 concat
data of a dynset requires more than 4 registers, resulting in the assert in
netlink_gen_expr when generating netlink info for the dynset data.

Signed-off-by: Son Dinh <dinhtrason@gmail.com>
---
 src/netlink_linearize.c            |  6 ++---
 tests/py/ip/sets.t                 |  2 ++
 tests/py/ip/sets.t.json            | 37 ++++++++++++++++++++++++++++++
 tests/py/ip/sets.t.payload.inet    | 11 +++++++++
 tests/py/ip/sets.t.payload.ip      |  8 +++++++
 tests/py/ip/sets.t.payload.netdev  | 10 ++++++++
 tests/py/ip6/sets.t                |  3 +++
 tests/py/ip6/sets.t.json           | 37 ++++++++++++++++++++++++++++++
 tests/py/ip6/sets.t.payload.inet   | 11 +++++++++
 tests/py/ip6/sets.t.payload.ip6    |  8 +++++++
 tests/py/ip6/sets.t.payload.netdev | 10 ++++++++
 tests/py/nft-test.py               |  4 ++++
 12 files changed, 144 insertions(+), 3 deletions(-)

diff --git src/netlink_linearize.c src/netlink_linearize.c
index 6204d8fd..de9e975f 100644
--- src/netlink_linearize.c
+++ src/netlink_linearize.c
@@ -1592,11 +1592,11 @@ static void netlink_gen_map_stmt(struct netlink_linearize_ctx *ctx,
 	sreg_key = get_register(ctx, stmt->map.key->key);
 	netlink_gen_expr(ctx, stmt->map.key->key, sreg_key);
 
-	sreg_data = get_register(ctx, stmt->map.data);
-	netlink_gen_expr(ctx, stmt->map.data, sreg_data);
+	sreg_data = get_register(ctx, stmt->map.data->key);
+	netlink_gen_expr(ctx, stmt->map.data->key, sreg_data);
 
 	release_register(ctx, stmt->map.key->key);
-	release_register(ctx, stmt->map.data);
+	release_register(ctx, stmt->map.data->key);
 
 	nle = alloc_nft_expr("dynset");
 	netlink_put_register(nle, NFTNL_EXPR_DYNSET_SREG_KEY, sreg_key);
diff --git tests/py/ip/sets.t tests/py/ip/sets.t
index 46d9686b..828a1f1f 100644
--- tests/py/ip/sets.t
+++ tests/py/ip/sets.t
@@ -66,3 +66,5 @@ ip saddr @set6 drop;ok
 ip saddr vmap { 1.1.1.1 : drop, * : accept };ok
 meta mark set ip saddr map { 1.1.1.1 : 0x00000001, * : 0x00000002 };ok
 
+!map2 type ipv4_addr . ipv4_addr . inet_service : ipv4_addr . inet_service;ok
+add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 };ok
\ No newline at end of file
diff --git tests/py/ip/sets.t.json tests/py/ip/sets.t.json
index 44ca1528..f2637d93 100644
--- tests/py/ip/sets.t.json
+++ tests/py/ip/sets.t.json
@@ -303,3 +303,40 @@
     }
 ]
 
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+[
+    {
+        "map": {
+            "data": {
+                "concat": [
+                    "10.0.0.1",
+                    80
+                ]
+            },
+            "elem": {
+                "concat": [
+                    {
+                        "payload": {
+                            "field": "saddr",
+                            "protocol": "ip"
+                        }
+                    },
+                    {
+                        "payload": {
+                            "field": "daddr",
+                            "protocol": "ip"
+                        }
+                    },
+                    {
+                        "payload": {
+                            "field": "dport",
+                            "protocol": "th"
+                        }
+                    }
+                ]
+            },
+            "map": "@map2",
+            "op": "add"
+        }
+    }
+]
diff --git tests/py/ip/sets.t.payload.inet tests/py/ip/sets.t.payload.inet
index fd6517a5..cc04b43d 100644
--- tests/py/ip/sets.t.payload.inet
+++ tests/py/ip/sets.t.payload.inet
@@ -104,3 +104,14 @@ inet
   [ payload load 4b @ network header + 12 => reg 1 ]
   [ lookup reg 1 set __map%d dreg 1 ]
   [ meta set mark with reg 1 ]
+
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+inet test-inet input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+  [ payload load 4b @ network header + 12 => reg 1 ]
+  [ payload load 4b @ network header + 16 => reg 9 ]
+  [ payload load 2b @ transport header + 2 => reg 10 ]
+  [ immediate reg 11 0x0100000a ]
+  [ immediate reg 2 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip/sets.t.payload.ip tests/py/ip/sets.t.payload.ip
index d9cc32b6..f9ee1f98 100644
--- tests/py/ip/sets.t.payload.ip
+++ tests/py/ip/sets.t.payload.ip
@@ -81,3 +81,11 @@ ip test-ip4 input
   [ meta load mark => reg 10 ]
   [ dynset add reg_key 1 set map1 sreg_data 10 ]
 
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+ip test-ip4 input
+  [ payload load 4b @ network header + 12 => reg 1 ]
+  [ payload load 4b @ network header + 16 => reg 9 ]
+  [ payload load 2b @ transport header + 2 => reg 10 ]
+  [ immediate reg 11 0x0100000a ]
+  [ immediate reg 2 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip/sets.t.payload.netdev tests/py/ip/sets.t.payload.netdev
index d41b9e8b..3d0dc79a 100644
--- tests/py/ip/sets.t.payload.netdev
+++ tests/py/ip/sets.t.payload.netdev
@@ -105,3 +105,13 @@ netdev test-netdev ingress
   [ meta load mark => reg 10 ]
   [ dynset add reg_key 1 set map1 sreg_data 10 ]
 
+# add @map2 { ip saddr . ip daddr . th dport : 10.0.0.1 . 80 }
+netdev test-netdev ingress
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+  [ payload load 4b @ network header + 12 => reg 1 ]
+  [ payload load 4b @ network header + 16 => reg 9 ]
+  [ payload load 2b @ transport header + 2 => reg 10 ]
+  [ immediate reg 11 0x0100000a ]
+  [ immediate reg 2 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 11 ]
diff --git tests/py/ip6/sets.t tests/py/ip6/sets.t
index 17fd62f5..cc26bd22 100644
--- tests/py/ip6/sets.t
+++ tests/py/ip6/sets.t
@@ -46,3 +46,6 @@ add @set5 { ip6 saddr . ip6 daddr };ok
 add @map1 { ip6 saddr . ip6 daddr : meta mark };ok
 
 delete @set5 { ip6 saddr . ip6 daddr };ok
+
+!map2 type ipv6_addr . ipv6_addr . inet_service : ipv6_addr . inet_service;ok
+add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 };ok
\ No newline at end of file
diff --git tests/py/ip6/sets.t.json tests/py/ip6/sets.t.json
index 2029d2b5..99236099 100644
--- tests/py/ip6/sets.t.json
+++ tests/py/ip6/sets.t.json
@@ -148,3 +148,40 @@
     }
 ]
 
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+[
+    {
+        "map": {
+            "data": {
+                "concat": [
+                    "1234::1",
+                    80
+                ]
+            },
+            "elem": {
+                "concat": [
+                    {
+                        "payload": {
+                            "field": "saddr",
+                            "protocol": "ip6"
+                        }
+                    },
+                    {
+                        "payload": {
+                            "field": "daddr",
+                            "protocol": "ip6"
+                        }
+                    },
+                    {
+                        "payload": {
+                            "field": "dport",
+                            "protocol": "th"
+                        }
+                    }
+                ]
+            },
+            "map": "@map2",
+            "op": "add"
+        }
+    }
+]
diff --git tests/py/ip6/sets.t.payload.inet tests/py/ip6/sets.t.payload.inet
index 2bbd5573..2dbb818a 100644
--- tests/py/ip6/sets.t.payload.inet
+++ tests/py/ip6/sets.t.payload.inet
@@ -47,3 +47,14 @@ inet test-inet input
   [ payload load 16b @ network header + 8 => reg 1 ]
   [ payload load 16b @ network header + 24 => reg 2 ]
   [ dynset delete reg_key 1 set set5 ]
+
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+inet test-inet input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x0000000a ]
+  [ payload load 16b @ network header + 8 => reg 1 ]
+  [ payload load 16b @ network header + 24 => reg 2 ]
+  [ payload load 2b @ transport header + 2 => reg 3 ]
+  [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+  [ immediate reg 21 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/ip6/sets.t.payload.ip6 tests/py/ip6/sets.t.payload.ip6
index c59f7b5c..7234b989 100644
--- tests/py/ip6/sets.t.payload.ip6
+++ tests/py/ip6/sets.t.payload.ip6
@@ -36,3 +36,11 @@ ip6 test-ip6 input
   [ meta load mark => reg 3 ]
   [ dynset add reg_key 1 set map1 sreg_data 3 ]
 
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+ip6 test-ip6 input
+  [ payload load 16b @ network header + 8 => reg 1 ]
+  [ payload load 16b @ network header + 24 => reg 2 ]
+  [ payload load 2b @ transport header + 2 => reg 3 ]
+  [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+  [ immediate reg 21 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/ip6/sets.t.payload.netdev tests/py/ip6/sets.t.payload.netdev
index 1866d26b..2ad0f434 100644
--- tests/py/ip6/sets.t.payload.netdev
+++ tests/py/ip6/sets.t.payload.netdev
@@ -48,3 +48,13 @@ netdev test-netdev ingress
   [ meta load mark => reg 3 ]
   [ dynset add reg_key 1 set map1 sreg_data 3 ]
 
+# add @map2 { ip6 saddr . ip6 daddr . th dport : 1234::1 . 80 }
+netdev test-netdev ingress
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x0000dd86 ]
+  [ payload load 16b @ network header + 8 => reg 1 ]
+  [ payload load 16b @ network header + 24 => reg 2 ]
+  [ payload load 2b @ transport header + 2 => reg 3 ]
+  [ immediate reg 17 0x00003412 0x00000000 0x00000000 0x01000000 ]
+  [ immediate reg 21 0x00005000 ]
+  [ dynset add reg_key 1 set map2 sreg_data 17 ]
diff --git tests/py/nft-test.py tests/py/nft-test.py
index a7d27c25..eafa258e 100755
--- tests/py/nft-test.py
+++ tests/py/nft-test.py
@@ -1162,6 +1162,10 @@ def set_process(set_line, filename, lineno):
         set_data = tokens[i+1]
         i += 2
 
+    while len(tokens) > i and tokens[i] == ".":
+        set_data += " . " + tokens[i+1]
+        i += 2
+
     if parse_typeof and tokens[i] == "mark":
         set_data += " " + tokens[i]
         i += 1;
-- 
2.44.0.windows.1