From 98c51aaac42b6d180f198d3d2f5b3425ab63ad72 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 10 Jan 2024 19:05:35 +0100 Subject: evaluate: bail out if anonymous concat set defines a non concat expression Iterate over the element list in the anonymous set to validate that all expressions are concatenations, otherwise bail out. ruleset.nft:3:46-53: Error: expression is not a concatenation ip protocol . th dport vmap { tcp / 22 : accept, tcp . 80 : drop} ^^^^^^^^ This is based on a patch from Florian Westphal. Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_map | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_map (limited to 'tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_map') diff --git a/tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_map b/tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_map new file mode 100644 index 00000000..3da16ce1 --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_map @@ -0,0 +1,5 @@ +table ip x { + chain y { + meta mark set ip protocol . th dport map { tcp / 22 : 1234, udp . 67 : 1234 } + } +} -- cgit v1.2.3