[PATCH nft] src: Allow for empty set variable definition

[PATCH nft] src: Allow for empty set variable definition

[Pablo Neira Ayuso]

Allow for empty set definition in variables if they are merged to
non-empty set definition:

 define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443}
 define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}

 table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        tcp dport {$BASE_ALLOWED_INCOMING_TCP_PORTS, $EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
    }
 }

However, disallow this:

 define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}

 table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
    }
 }

 # nft -f x.nft
 /tmp/x.nft:6:18-52: Error: Set is empty
        tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/evaluate.c                                  |  3 +++
 src/parser_bison.y                              |  1 +
 tests/shell/testcases/sets/0049set_define_0     | 16 ++++++++++++++++
 tests/shell/testcases/sets/0050set_define_1     | 17 +++++++++++++++++
 .../shell/testcases/sets/dumps/0049set_define_0 |  6 ++++++
 5 files changed, 43 insertions(+)
 create mode 100755 tests/shell/testcases/sets/0049set_define_0
 create mode 100755 tests/shell/testcases/sets/0050set_define_1
 create mode 100644 tests/shell/testcases/sets/dumps/0049set_define_0

diff --git a/src/evaluate.c b/src/evaluate.c
index 827ee48a48ed..2bfe55524fac 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1897,6 +1897,9 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
 				return -1;
 			break;
 		case EXPR_SET:
+			if (right->size == 0)
+				return expr_error(ctx->msgs, right, "Set is empty");
+
 			right = rel->right =
 				implicit_set_declaration(ctx, "__set%d",
 							 expr_get(left), NULL,
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 8a04d3b409a5..1676aa33e431 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -3845,6 +3845,7 @@ set_rhs_expr		:	concat_rhs_expr
 
 initializer_expr	:	rhs_expr
 			|	list_rhs_expr
+			|	'{' '}'		{ $$ = compound_expr_alloc(&@$, EXPR_SET); }
 			;
 
 counter_config		:	PACKETS		NUM	BYTES	NUM
diff --git a/tests/shell/testcases/sets/0049set_define_0 b/tests/shell/testcases/sets/0049set_define_0
new file mode 100755
index 000000000000..1d512f7b5a54
--- /dev/null
+++ b/tests/shell/testcases/sets/0049set_define_0
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443}
+define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}
+
+table inet filter {
+	chain input {
+		type filter hook input priority 0; policy drop;
+		tcp dport {\$BASE_ALLOWED_INCOMING_TCP_PORTS, \$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
+	}
+}
+"
+
+$NFT -f - <<< "$EXPECTED"
diff --git a/tests/shell/testcases/sets/0050set_define_1 b/tests/shell/testcases/sets/0050set_define_1
new file mode 100755
index 000000000000..c12de177c7ec
--- /dev/null
+++ b/tests/shell/testcases/sets/0050set_define_1
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="define BASE_ALLOWED_INCOMING_TCP_PORTS = {}
+
+table inet filter {
+	chain input {
+		type filter hook input priority 0; policy drop;
+		tcp dport {\$BASE_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
+	}
+}
+"
+
+$NFT -f - <<< "$EXPECTED" &> /dev/null || exit 0
+echo "E: Accepted empty set" 1>&2
+exit 1
diff --git a/tests/shell/testcases/sets/dumps/0049set_define_0 b/tests/shell/testcases/sets/dumps/0049set_define_0
new file mode 100644
index 000000000000..998b387a8151
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/0049set_define_0
@@ -0,0 +1,6 @@
+table inet filter {
+	chain input {
+		type filter hook input priority filter; policy drop;
+		tcp dport { 22, 80, 443 } ct state new counter packets 0 bytes 0 accept
+	}
+}
-- 
2.20.1