Support 'nft -f -' to read from stdin

In libnftables, detect if given filename is '-' and treat it as the
common way of requesting to read from stdin, then open /dev/stdin
instead. (Calling 'nft -f /dev/stdin' worked before as well, but this
makes it official.)

With this in place and bash's support for here strings, review all tests
in tests/shell for needless use of temp files. Note that two categories
of test cases were intentionally left unchanged:

- Tests creating potentially large rulesets to avoid running into shell
  parameter length limits.
- Tests for 'include' directive for obvious reasons.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 4 insertions, 13 deletions

diff --git a/tests/shell/testcases/sets/0022type_selective_flush_0 b/tests/shell/testcases/sets/0022type_selective_flush_0
index 659bf70c..0c39cbad 100755
--- a/tests/shell/testcases/sets/0022type_selective_flush_0
+++ b/tests/shell/testcases/sets/0022type_selective_flush_0
@@ -3,23 +3,15 @@
 # This tests the selectiveness of flush command on structures that use the
 # generic set infrastructure (sets, maps and meters).
 
-tmpfile=$(mktemp)
-if [ ! -w $tmpfile ] ; then
-	echo "Failed to create tmp file" >&2
-	exit 0
-fi
-
-trap "rm -rf $tmpfile" EXIT # cleanup if aborted
-
-echo "
+RULESET="
 add table t
 add chain t c
 add set t s {type ipv4_addr;}
 add map t m {type ipv4_addr : inet_service;}
 add rule t c tcp dport 80 meter f {ip saddr limit rate 10/second}
-" >$tmpfile
+"
 
-$NFT -f $tmpfile
+$NFT -f - <<< $RULESET
 
 # Commands that should be invalid
 
@@ -31,8 +23,7 @@ declare -a cmds=(
 
 for i in "${cmds[@]}"
 do
-	echo "$i" >$tmpfile
-	$NFT -f $tmpfile &>/dev/null
+	$NFT "$i" &>/dev/null
 	ret=$?
 
 	if [ $ret -eq 0 ]; then