[PATCH nft] optimize: fix vmap with anonymous sets

[PATCH nft] optimize: fix vmap with anonymous sets

[Pablo Neira Ayuso]

The following example ruleset crashes:

 table inet a {
        chain b {
                tcp dport { 1 } accept
                tcp dport 2-3 drop
        }
 }

because handling for EXPR_SET is missing.

Fixes: 1542082e259b ("optimize: merge same selector with different verdict into verdict map")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/optimize.c                                            | 8 ++++++--
 .../testcases/optimizations/dumps/merge_stmts_vmap.nft    | 4 ++++
 tests/shell/testcases/optimizations/merge_stmts_vmap      | 4 ++++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/optimize.c b/src/optimize.c
index 04523edb795b..64c0a4dbe764 100644
--- a/src/optimize.c
+++ b/src/optimize.c
@@ -435,18 +435,22 @@ static void build_verdict_map(struct expr *expr, struct stmt *verdict, struct ex
 {
 	struct expr *item, *elem, *mapping;
 
-	if (expr->etype == EXPR_LIST) {
+	switch (expr->etype) {
+	case EXPR_LIST:
+	case EXPR_SET:
 		list_for_each_entry(item, &expr->expressions, list) {
 			elem = set_elem_expr_alloc(&internal_location, expr_get(item));
 			mapping = mapping_expr_alloc(&internal_location, elem,
 						     expr_get(verdict->expr));
 			compound_expr_add(set, mapping);
 		}
-	} else {
+		break;
+	default:
 		elem = set_elem_expr_alloc(&internal_location, expr_get(expr));
 		mapping = mapping_expr_alloc(&internal_location, elem,
 					     expr_get(verdict->expr));
 		compound_expr_add(set, mapping);
+		break;
 	}
 }
 
diff --git a/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft b/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft
index 9fa19afcb783..427572954a18 100644
--- a/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft
+++ b/tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.nft
@@ -2,4 +2,8 @@ table ip x {
 	chain y {
 		ct state vmap { invalid : drop, established : accept, related : accept }
 	}
+
+	chain z {
+		tcp dport vmap { 1 : accept, 2-3 : drop }
+	}
 }
diff --git a/tests/shell/testcases/optimizations/merge_stmts_vmap b/tests/shell/testcases/optimizations/merge_stmts_vmap
index f838fcfed70b..6511c7b20cb6 100755
--- a/tests/shell/testcases/optimizations/merge_stmts_vmap
+++ b/tests/shell/testcases/optimizations/merge_stmts_vmap
@@ -7,6 +7,10 @@ RULESET="table ip x {
 		ct state invalid drop
 		ct state established,related accept
 	}
+	chain z {
+		tcp dport { 1 } accept
+		tcp dport 2-3 drop
+	}
 }"
 
 $NFT -o -f - <<< $RULESET
-- 
2.30.2