From 98c51aaac42b6d180f198d3d2f5b3425ab63ad72 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 10 Jan 2024 19:05:35 +0100 Subject: evaluate: bail out if anonymous concat set defines a non concat expression Iterate over the element list in the anonymous set to validate that all expressions are concatenations, otherwise bail out. ruleset.nft:3:46-53: Error: expression is not a concatenation ip protocol . th dport vmap { tcp / 22 : accept, tcp . 80 : drop} ^^^^^^^^ This is based on a patch from Florian Westphal. Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_vmap | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_vmap (limited to 'tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_vmap') diff --git a/tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_vmap b/tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_vmap new file mode 100644 index 00000000..f4dc273f --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/unhandled_key_type_13_assert_vmap @@ -0,0 +1,5 @@ +table ip x { + chain y { + ip protocol . th dport vmap { tcp / 22 : accept, udp . 67 : drop } + } +} -- cgit v1.2.3