src: Allow for empty set variable definition

Allow for empty set definition in variables if they are merged to
non-empty set definition:

 define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443}
 define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}

 table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        tcp dport {$BASE_ALLOWED_INCOMING_TCP_PORTS, $EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
    }
 }

However, disallow this:

 define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}

 table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
    }
 }

 # nft -f x.nft
 /tmp/x.nft:6:18-52: Error: Set is empty
        tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 3 insertions, 0 deletions

diff --git a/src/evaluate.c b/src/evaluate.c
index 42040b6e..640a7d46 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1897,6 +1897,9 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
 				return -1;
 			break;
 		case EXPR_SET:
+			if (right->size == 0)
+				return expr_error(ctx->msgs, right, "Set is empty");
+
 			right = rel->right =
 				implicit_set_declaration(ctx, "__set%d",
 							 expr_get(left), NULL,