diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-07-03 13:24:59 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-07-04 00:06:46 +0200 |
commit | 9297f5b5301b76bb24513b114f905e6fac0a90cd (patch) | |
tree | aac5219a11cde63e57185948523b552b64d8b62b /tests/shell/testcases/sets/0050set_define_1 | |
parent | fb1486439b6d62cad104b83ecd04ec1a54fc9cae (diff) |
src: Allow for empty set variable definition
Allow for empty set definition in variables if they are merged to
non-empty set definition:
define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443}
define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
tcp dport {$BASE_ALLOWED_INCOMING_TCP_PORTS, $EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
}
}
However, disallow this:
define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
}
}
# nft -f x.nft
/tmp/x.nft:6:18-52: Error: Set is empty
tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/shell/testcases/sets/0050set_define_1')
-rwxr-xr-x | tests/shell/testcases/sets/0050set_define_1 | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/tests/shell/testcases/sets/0050set_define_1 b/tests/shell/testcases/sets/0050set_define_1 new file mode 100755 index 00000000..c12de177 --- /dev/null +++ b/tests/shell/testcases/sets/0050set_define_1 @@ -0,0 +1,17 @@ +#!/bin/bash + +set -e + +EXPECTED="define BASE_ALLOWED_INCOMING_TCP_PORTS = {} + +table inet filter { + chain input { + type filter hook input priority 0; policy drop; + tcp dport {\$BASE_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept + } +} +" + +$NFT -f - <<< "$EXPECTED" &> /dev/null || exit 0 +echo "E: Accepted empty set" 1>&2 +exit 1 |