src: Allow for empty set variable definition

Allow for empty set definition in variables if they are merged to
non-empty set definition:

 define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443}
 define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}

 table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        tcp dport {$BASE_ALLOWED_INCOMING_TCP_PORTS, $EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
    }
 }

However, disallow this:

 define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}

 table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
    }
 }

 # nft -f x.nft
 /tmp/x.nft:6:18-52: Error: Set is empty
        tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 6 insertions, 0 deletions

diff --git a/tests/shell/testcases/sets/dumps/0049set_define_0.nft b/tests/shell/testcases/sets/dumps/0049set_define_0.nft
new file mode 100644
index 00000000..998b387a
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/0049set_define_0.nft
@@ -0,0 +1,6 @@
+table inet filter {
+	chain input {
+		type filter hook input priority filter; policy drop;
+		tcp dport { 22, 80, 443 } ct state new counter packets 0 bytes 0 accept
+	}
+}