On Thu,  4 Sep 2025 22:01:26 +0000 Asbjørn Sloth Tønnesen wrote:

Add a check to verify that the sub-type is "nest", and throw an
exception if no policy could be generated, as a guard to prevent
against generating a bad policy.

This is a trivial patch with no behavioural changes intended.

I _think_ the expectation was that one of the other methods which
validate the types more thoroughly has to be called if this one is.
But either way:

Reviewed-by: Jakub Kicinski <kuba@kernel.org>