From faa6908fad6053ae9549c45b88d0402cc69cf1ed Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 22 Nov 2023 20:35:07 +0100 Subject: evaluate: clone unary expression datatype to deal with dynamic datatype When allocating a unary expression, clone the datatype to deal with dynamic datatypes. Fixes: 6b01bb9ff798 ("datatype: concat expression only releases dynamically allocated datatype") Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/maps/dumps/vmap_unary.nft | 11 +++++++++++ tests/shell/testcases/maps/vmap_unary | 17 +++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 tests/shell/testcases/maps/dumps/vmap_unary.nft create mode 100755 tests/shell/testcases/maps/vmap_unary (limited to 'tests/shell/testcases') diff --git a/tests/shell/testcases/maps/dumps/vmap_unary.nft b/tests/shell/testcases/maps/dumps/vmap_unary.nft new file mode 100644 index 00000000..46c538b7 --- /dev/null +++ b/tests/shell/testcases/maps/dumps/vmap_unary.nft @@ -0,0 +1,11 @@ +table ip filter { + map ipsec_in { + typeof ipsec in reqid . iif : verdict + flags interval + } + + chain INPUT { + type filter hook input priority filter; policy drop; + ipsec in reqid . iif vmap @ipsec_in + } +} diff --git a/tests/shell/testcases/maps/vmap_unary b/tests/shell/testcases/maps/vmap_unary new file mode 100755 index 00000000..4038d1c1 --- /dev/null +++ b/tests/shell/testcases/maps/vmap_unary @@ -0,0 +1,17 @@ +#!/bin/bash + +set -e + +RULESET="table ip filter { + map ipsec_in { + typeof ipsec in reqid . iif : verdict + flags interval + } + + chain INPUT { + type filter hook input priority 0; policy drop + ipsec in reqid . iif vmap @ipsec_in + } +}" + +$NFT -f - <<< $RULESET -- cgit v1.2.3