[PATCH nft] segtree: always close interval in non-anonymous sets

[Pablo Neira Ayuso <pablo@netfilter.org>]

Skip this optimization for non-anonymous sets, otherwise, element
deletion breaks.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/segtree.c                                      |  3 +-
 .../shell/testcases/maps/0008interval_map_delete_0 | 32 ++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100755 tests/shell/testcases/maps/0008interval_map_delete_0

diff --git a/src/segtree.c b/src/segtree.c
index eff0653a8dfb..5d6ecd4fcab1 100644
--- a/src/segtree.c
+++ b/src/segtree.c
@@ -496,7 +496,8 @@ static void segtree_linearize(struct list_head *list, const struct set *set,
 			 * (prev_right, ei_left).
 			 */
 			mpz_add_ui(p, prev->right, 1);
-			if (mpz_cmp(p, ei->left) < 0) {
+			if (mpz_cmp(p, ei->left) < 0 ||
+			    !(set->flags & NFT_SET_ANONYMOUS)) {
 				mpz_sub_ui(q, ei->left, 1);
 				nei = ei_alloc(p, q, NULL, EI_F_INTERVAL_END);
 				list_add_tail(&nei->list, list);
diff --git a/tests/shell/testcases/maps/0008interval_map_delete_0 b/tests/shell/testcases/maps/0008interval_map_delete_0
new file mode 100755
index 000000000000..a43fd28019f7
--- /dev/null
+++ b/tests/shell/testcases/maps/0008interval_map_delete_0
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="table ip filter {
+	map m {
+		type ipv4_addr : mark
+		flags interval
+		elements = { 127.0.0.2 : 0x00000002, 127.0.0.3 : 0x00000003 }
+	}
+
+	chain input {
+		type filter hook input priority filter; policy accept;
+		meta mark set ip daddr map @m
+		meta mark 0x00000002 counter accept
+		meta mark 0x00000003 counter accept
+		counter
+	}
+}"
+
+$NFT -f - <<< "$EXPECTED"
+$NFT delete element filter m { 127.0.0.2 }
+$NFT delete element filter m { 127.0.0.3 }
+$NFT add element filter m { 127.0.0.3 : 0x3 }
+$NFT add element filter m { 127.0.0.2 : 0x2 }
+
+GET=$($NFT list ruleset -s)
+if [ "$EXPECTED" != "$GET" ] ; then
+	DIFF="$(which diff)"
+	[ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+	exit 1
+fi
-- 
2.11.0