default dispositions to continue before the nil-conf return; test bad disposition values

internal/config/config_test.go

@@ -1052,3 +1052,20 @@ func TestSplitZoneList(t *testing.T) {
 		}
 	}
 }
+
+func TestValidateDispositions(t *testing.T) {
+	for _, tc := range []struct {
+		invalid, untracked PolicyAction
+		wantErr            string
+	}{
+		{"", "", ""},
+		{PolicyContinue, PolicyDrop, ""},
+		{"bogus", "", `unknown invalid_disposition "bogus"`},
+		{PolicyAccept, "log", `unknown untracked_disposition "log"`},
+	} {
+		c := baseConfig()
+		c.Settings.InvalidDisposition = tc.invalid
+		c.Settings.UntrackedDisposition = tc.untracked
+		checkErr(t, c.Validate(), tc.wantErr)
+	}
+}

internal/shorewall/convert.go

@@ -124,6 +124,8 @@ func convertConf(dir string, cfg *config.Config, params map[string]string, ipv6
 	if err != nil {
 		return err
 	}
+	cfg.Settings.InvalidDisposition = disposition(conf["INVALID_DISPOSITION"])
+	cfg.Settings.UntrackedDisposition = disposition(conf["UNTRACKED_DISPOSITION"])
 	if conf == nil {
 		return nil
 	}
@@ -145,9 +147,6 @@ func convertConf(dir string, cfg *config.Config, params map[string]string, ipv6
 	if v, ok := conf["IMPLICIT_CONTINUE"]; ok {
 		cfg.Settings.ImplicitContinue = v == "Yes"
 	}
-	cfg.Settings.InvalidDisposition = disposition(conf["INVALID_DISPOSITION"])
-	cfg.Settings.UntrackedDisposition = disposition(conf["UNTRACKED_DISPOSITION"])
-
 	return nil
 }
 

internal/shorewall/convert_test.go

@@ -731,6 +731,7 @@ func TestConvert_Dispositions(t *testing.T) {
 		conf               string
 		invalid, untracked config.PolicyAction
 	}{
+		{"", config.PolicyContinue, config.PolicyContinue},
 		{"IP_FORWARDING=Yes", config.PolicyContinue, config.PolicyContinue},
 		{"INVALID_DISPOSITION=CONTINUE\nUNTRACKED_DISPOSITION=ACCEPT", config.PolicyContinue, config.PolicyAccept},
 		{"INVALID_DISPOSITION=DROP\nUNTRACKED_DISPOSITION=A_DROP", config.PolicyDrop, config.PolicyDrop},