Re: [nft PATCH 2/3] src/evaluate.c: improve rule management checks

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Mar 28, 2016 at 01:32:41PM +0200, Arturo Borrero Gonzalez wrote:
> +static int rule_evaluate_cmd(struct eval_ctx *ctx)
> +{
> +	struct handle *handle = &ctx->cmd->handle;
> +
> +	/* allowed:
> +	 * - insert [position] (no handle)
> +	 * - add [position] (no handle)
> +	 * - replace <handle> (no position)
> +	 * - delete <handle> (no position)
> +	 */
> +
> +	switch (ctx->cmd->op) {
> +	case CMD_INSERT:
> +		if (handle->handle.id && handle->position.id)
> +			return handle_position_error(ctx, "Could not insert "
> +						     "rule: wrong combination"
> +						     ", use only `position' "
> +						     "instead");

I know we have this "Could not insert rule:" thing in other four spots
in the evaluation.c, but those are my fault and I'll get rid of them
soon.

Given that we now have good error reporting through location, I
suggest you use the shortened version.

	return handle_position_error(ctx, "you cannot combine this");

The error reporting we have visualizes the problem to the user.

Thanks.