From b1436403417697b8647956ff91d40a5982aba477 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 6 Mar 2019 00:51:03 +0100 Subject: segtree: add missing non-matching segment to set in flat representation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit # cat test.nft add set x y { type ipv4_addr; } add element x y { 10.0.24.0/24 } # nft -f test.nft # nft delete element x y { 10.0.24.0/24 } bogusly returns -ENOENT. The non-matching segment (0.0.0.0 with end-flag set on) is not added to the set in the example above. This patch also adds a test to cover this case. Fixes: 4935a0d561b5 ("segtree: special handling for the first non-matching segment") Reported-by: Václav Zindulka Signed-off-by: Pablo Neira Ayuso --- src/segtree.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'src/segtree.c') diff --git a/src/segtree.c b/src/segtree.c index 939c30d2..6ee65523 100644 --- a/src/segtree.c +++ b/src/segtree.c @@ -431,16 +431,19 @@ static bool segtree_needs_first_segment(const struct set *set, const struct expr *init, bool add) { if (add) { - /* Add the first segment in three situations: + /* Add the first segment in four situations: * * 1) This is an anonymous set. * 2) This set exists and it is empty. - * 3) This set is created with a number of initial elements. + * 3) New empty set and, separately, new elements are added. + * 4) This set is created with a number of initial elements. */ if ((set->flags & NFT_SET_ANONYMOUS) || (set->init && set->init->size == 0) || - (set->init == init)) + (set->init == NULL && init) || + (set->init == init)) { return true; + } } else { /* If the set is empty after the removal, we have to * remove the first non-matching segment too. -- cgit v1.2.3