libnftables: add base directory of -f/--filename to include path

This patch adds an include path relative to the current (the including)
file's directory.

Users of -f/--filename have to explicitly specify -I with a redundant
path to find included files in the main file, eg.

 # nft -I /path/to/files -f /path/to/files/ruleset.nft

Assuming:

 # cat /path/to/files/ruleset.nft
 include "file1.nft"
 include "file2.nft"
 include "file3.nft"

The follow up patch ("libnftables: search for default include path last")
is also required according to what it is described in the manpage update
coming with this patch.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1661
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/doc/nft.txt b/doc/nft.txt
index e4eb982e75af875b236ca05f697ee8776244815f..3f4593a298312071e7a07c06dc2039f9317eacc9 100644 (file)
--- a/doc/nft.txt
+++ b/doc/nft.txt
@@ -43,6 +43,8 @@ understanding of their meaning. You can get information about options by running
 *-f*::
 *--file 'filename'*::
        Read input from 'filename'. If 'filename' is -, read from stdin.
+       The directory path to this file is inserted at the beginning the list of
+       directories to be searched for included files (see *-I/--includepath*).
 
 *-D*::
 *--define 'name=value'*::

diff --git a/src/libnftables.c b/src/libnftables.c
index 0dee1bacb0db3ed4e8558746cb2580bb1616b2a6..40e37bdf8c0668f55cbb971f78d7995e367bb457 100644 (file)
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -17,6 +17,7 @@
 #include <cmd.h>
 #include <errno.h>
 #include <sys/stat.h>
+#include <libgen.h>
 
 static int nft_netlink(struct nft_ctx *nft,
                       struct list_head *cmds, struct list_head *msgs)
@@ -786,6 +787,19 @@ static int nft_run_optimized_file(struct nft_ctx *nft, const char *filename)
        return __nft_run_cmd_from_filename(nft, filename);
 }
 
+static int nft_ctx_add_basedir_include_path(struct nft_ctx *nft,
+                                           const char *filename)
+{
+       const char *basedir = dirname(xstrdup(filename));
+       int ret;
+
+       ret = nft_ctx_add_include_path(nft, basedir);
+
+       free_const(basedir);
+
+       return ret;
+}
+
 EXPORT_SYMBOL(nft_run_cmd_from_filename);
 int nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename)
 {
@@ -798,6 +812,10 @@ int nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename)
            !nft_output_json(&nft->output))
                nft->stdin_buf = stdin_to_buffer();
 
+       if (!nft->stdin_buf &&
+           nft_ctx_add_basedir_include_path(nft, filename) < 0)
+               return -1;
+
        if (nft->optimize_flags) {
                ret = nft_run_optimized_file(nft, filename);
                free_const(nft->stdin_buf);