Re: [PATCH nf-next] netfilter: nf_tables: don't break when vmap lookup yields no result

[Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>]

Hi Florian,

On Sat, Feb 02, 2019 at 11:09:55AM +0100, Florian Westphal wrote:
> instead just let the eval loop continue with remaining expressions, if any.
> 
> This allows to catch non-matching packets in the same rule, e.g.:
> 
>  ip protocol vmap { tcp : jump tcp_tests,
>                     udp : jump udp_tests } counter jump other

We still need a way to set default stateful object, not only jumps.

Please, let me explore a patch to add a catch-all case and then we can
pick the best solution for this, either this patch or a new catch-all
case code.

Thanks.