Support 'nft -f -' to read from stdin

In libnftables, detect if given filename is '-' and treat it as the
common way of requesting to read from stdin, then open /dev/stdin
instead. (Calling 'nft -f /dev/stdin' worked before as well, but this
makes it official.)

With this in place and bash's support for here strings, review all tests
in tests/shell for needless use of temp files. Note that two categories
of test cases were intentionally left unchanged:

- Tests creating potentially large rulesets to avoid running into shell
  parameter length limits.
- Tests for 'include' directive for obvious reasons.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 3 insertions, 0 deletions

diff --git a/src/libnftables.c b/src/libnftables.c
index 9b2f65ae..6e271209 100644
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -313,6 +313,9 @@ int nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename)
 	if (rc < 0)
 		return -1;
 
+	if (!strcmp(filename, "-"))
+		filename = "/dev/stdin";
+
 	parser_init(nft->nf_sock, &nft->cache, &state,
 		    &msgs, nft->debug_mask, &nft->output);
 	scanner = scanner_init(&state);