diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-06-14 11:24:19 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-06-25 17:20:12 +0200 |
| commit | 302e9f8b3a1382cf09db32541693b5df7d80ca1e (patch) | |
| tree | dc38298820ace340cb2b87efa9b1da6d40a71056 | |
| parent | 2274d8a32f40aa55b118a9de2d642342837867b7 (diff) | |
libnftables: add base directory of -f/--filename to include path
This patch adds an include path relative to the current (the including)
file's directory.
Users of -f/--filename have to explicitly specify -I with a redundant
path to find included files in the main file, eg.
# nft -I /path/to/files -f /path/to/files/ruleset.nft
Assuming:
# cat /path/to/files/ruleset.nft
include "file1.nft"
include "file2.nft"
include "file3.nft"
The follow up patch ("libnftables: search for default include path last")
is also required according to what it is described in the manpage update
coming with this patch.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1661
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | doc/nft.txt | 2 | ||||
| -rw-r--r-- | src/libnftables.c | 18 |
2 files changed, 20 insertions, 0 deletions
diff --git a/doc/nft.txt b/doc/nft.txt index e4eb982e..3f4593a2 100644 --- a/doc/nft.txt +++ b/doc/nft.txt @@ -43,6 +43,8 @@ understanding of their meaning. You can get information about options by running *-f*:: *--file 'filename'*:: Read input from 'filename'. If 'filename' is -, read from stdin. + The directory path to this file is inserted at the beginning the list of + directories to be searched for included files (see *-I/--includepath*). *-D*:: *--define 'name=value'*:: diff --git a/src/libnftables.c b/src/libnftables.c index 0dee1bac..40e37bdf 100644 --- a/src/libnftables.c +++ b/src/libnftables.c @@ -17,6 +17,7 @@ #include <cmd.h> #include <errno.h> #include <sys/stat.h> +#include <libgen.h> static int nft_netlink(struct nft_ctx *nft, struct list_head *cmds, struct list_head *msgs) @@ -786,6 +787,19 @@ static int nft_run_optimized_file(struct nft_ctx *nft, const char *filename) return __nft_run_cmd_from_filename(nft, filename); } +static int nft_ctx_add_basedir_include_path(struct nft_ctx *nft, + const char *filename) +{ + const char *basedir = dirname(xstrdup(filename)); + int ret; + + ret = nft_ctx_add_include_path(nft, basedir); + + free_const(basedir); + + return ret; +} + EXPORT_SYMBOL(nft_run_cmd_from_filename); int nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename) { @@ -798,6 +812,10 @@ int nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename) !nft_output_json(&nft->output)) nft->stdin_buf = stdin_to_buffer(); + if (!nft->stdin_buf && + nft_ctx_add_basedir_include_path(nft, filename) < 0) + return -1; + if (nft->optimize_flags) { ret = nft_run_optimized_file(nft, filename); free_const(nft->stdin_buf); |