From 2ed5b958b47978d6ade20f6c16cbdea667479ac3 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 4 Oct 2026 15:35:58 +1100
Subject: [PATCH] default dispositions to continue before the nil-conf return;
 test bad disposition values

---
 internal/config/config_test.go     | 17 +++++++++++++++++
 internal/shorewall/convert.go      |  5 ++---
 internal/shorewall/convert_test.go |  1 +
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 7485bae..3eb3bbd 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -1052,3 +1052,20 @@ func TestSplitZoneList(t *testing.T) {
 		}
 	}
 }
+
+func TestValidateDispositions(t *testing.T) {
+	for _, tc := range []struct {
+		invalid, untracked PolicyAction
+		wantErr            string
+	}{
+		{"", "", ""},
+		{PolicyContinue, PolicyDrop, ""},
+		{"bogus", "", `unknown invalid_disposition "bogus"`},
+		{PolicyAccept, "log", `unknown untracked_disposition "log"`},
+	} {
+		c := baseConfig()
+		c.Settings.InvalidDisposition = tc.invalid
+		c.Settings.UntrackedDisposition = tc.untracked
+		checkErr(t, c.Validate(), tc.wantErr)
+	}
+}
diff --git a/internal/shorewall/convert.go b/internal/shorewall/convert.go
index 432009c..7d77edc 100644
--- a/internal/shorewall/convert.go
+++ b/internal/shorewall/convert.go
@@ -124,6 +124,8 @@ func convertConf(dir string, cfg *config.Config, params map[string]string, ipv6
 	if err != nil {
 		return err
 	}
+	cfg.Settings.InvalidDisposition = disposition(conf["INVALID_DISPOSITION"])
+	cfg.Settings.UntrackedDisposition = disposition(conf["UNTRACKED_DISPOSITION"])
 	if conf == nil {
 		return nil
 	}
@@ -145,9 +147,6 @@ func convertConf(dir string, cfg *config.Config, params map[string]string, ipv6
 	if v, ok := conf["IMPLICIT_CONTINUE"]; ok {
 		cfg.Settings.ImplicitContinue = v == "Yes"
 	}
-	cfg.Settings.InvalidDisposition = disposition(conf["INVALID_DISPOSITION"])
-	cfg.Settings.UntrackedDisposition = disposition(conf["UNTRACKED_DISPOSITION"])
-
 	return nil
 }
 
diff --git a/internal/shorewall/convert_test.go b/internal/shorewall/convert_test.go
index dda9037..4e46734 100644
--- a/internal/shorewall/convert_test.go
+++ b/internal/shorewall/convert_test.go
@@ -731,6 +731,7 @@ func TestConvert_Dispositions(t *testing.T) {
 		conf               string
 		invalid, untracked config.PolicyAction
 	}{
+		{"", config.PolicyContinue, config.PolicyContinue},
 		{"IP_FORWARDING=Yes", config.PolicyContinue, config.PolicyContinue},
 		{"INVALID_DISPOSITION=CONTINUE\nUNTRACKED_DISPOSITION=ACCEPT", config.PolicyContinue, config.PolicyAccept},
 		{"INVALID_DISPOSITION=DROP\nUNTRACKED_DISPOSITION=A_DROP", config.PolicyDrop, config.PolicyDrop},