check against definition type mismatch (objects vs. arrays)

fixes #3098

1 files changed, 27 insertions, 10 deletions

diff --git a/awall/policy.lua b/awall/policy.lua
index efd52e0..093390d 100644
--- a/awall/policy.lua
+++ b/awall/policy.lua
@@ -11,7 +11,9 @@ local raise = require('awall.uerror').raise
 
 local util = require('awall.util')
 local contains = util.contains
+local keys = util.keys
 local listpairs = util.listpairs
+local map = util.map
 
 
 local json = require('cjson')
@@ -29,7 +31,7 @@ end
 function PolicyConfig:expand()
 
    local function expand(value)
-      if type(value) == 'table' then return util.map(value, expand) end
+      if type(value) == 'table' then return map(value, expand) end
 
       local visited = {}
       local pattern = '%$(%a[%w_]*)'
@@ -212,22 +214,37 @@ function PolicySet:load()
 	       input[cls] = objs
 	       for k, v in pairs(objs) do source[cls][k] = name end
 
-	    elseif objs[1] then
-	       local last = #input[cls]
-	       util.extend(input[cls], objs)
-	       for i = 1,#objs do source[cls][last + i] = name end
-
 	    else
-	       for k, v in pairs(objs) do
-		  input[cls][k] = v
-		  source[cls][k] = name
+	       local fk = next(input[cls])
+	       map(
+		  keys(objs),
+		  function(k)
+		     if type(k) ~= type(fk) then
+			raise(
+			   'Type mismatch in '..cls..' definitions ('..
+			      name..', '..source[cls][fk]..')'
+			)
+		     end
+		  end
+	       )
+
+	       if objs[1] then
+		  local last = #input[cls]
+		  util.extend(input[cls], objs)
+		  for i = 1,#objs do source[cls][last + i] = name end
+
+	       else
+		  for k, v in pairs(objs) do
+		     input[cls][k] = v
+		     source[cls][k] = name
+		  end
 	       end
 	    end
 	 end
       end
    end
 
-   return PolicyConfig(input, source, util.keys(imported))
+   return PolicyConfig(input, source, keys(imported))
 end
 
 return PolicySet