diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-07-03 13:24:59 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-07-04 00:06:46 +0200 |
| commit | 9297f5b5301b76bb24513b114f905e6fac0a90cd (patch) | |
| tree | aac5219a11cde63e57185948523b552b64d8b62b /src | |
| parent | fb1486439b6d62cad104b83ecd04ec1a54fc9cae (diff) | |
src: Allow for empty set variable definition
Allow for empty set definition in variables if they are merged to
non-empty set definition:
define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443}
define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
tcp dport {$BASE_ALLOWED_INCOMING_TCP_PORTS, $EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
}
}
However, disallow this:
define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
}
}
# nft -f x.nft
/tmp/x.nft:6:18-52: Error: Set is empty
tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/evaluate.c | 3 | ||||
| -rw-r--r-- | src/parser_bison.y | 1 |
2 files changed, 4 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 42040b6e..640a7d46 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1897,6 +1897,9 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr) return -1; break; case EXPR_SET: + if (right->size == 0) + return expr_error(ctx->msgs, right, "Set is empty"); + right = rel->right = implicit_set_declaration(ctx, "__set%d", expr_get(left), NULL, diff --git a/src/parser_bison.y b/src/parser_bison.y index 461d9bf2..72e67186 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -3820,6 +3820,7 @@ set_rhs_expr : concat_rhs_expr initializer_expr : rhs_expr | list_rhs_expr + | '{' '}' { $$ = compound_expr_alloc(&@$, EXPR_SET); } ; counter_config : PACKETS NUM BYTES NUM |