[PATCH nft 1/3] scanner: honor absolute and relative paths via include file

[PATCH nft 1/3] scanner: honor absolute and relative paths via include file

[Pablo Neira Ayuso]

If the path refers to an absolute or relative path, do not check for the
default include paths, eg. /etc/nftables/.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1040
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/scanner.l | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/src/scanner.l b/src/scanner.l
index 88669d0..6f1a551 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -611,6 +611,13 @@ err:
 	return -1;
 }
 
+static bool search_in_include_path(const char *filename)
+{
+	return (strncmp(filename, "./", strlen("./") != 0) &&
+		strncmp(filename, "../", strlen("../") != 0) &&
+		filename[0] != '/');
+}
+
 int scanner_include_file(void *scanner, const char *filename,
 			 const struct location *loc)
 {
@@ -622,13 +629,16 @@ int scanner_include_file(void *scanner, const char *filename,
 	FILE *f;
 
 	f = NULL;
-	for (i = 0; i < INCLUDE_PATHS_MAX; i++) {
-		if (include_paths[i] == NULL)
-			break;
-		snprintf(buf, sizeof(buf), "%s/%s", include_paths[i], filename);
-		f = fopen(buf, "r");
-		if (f != NULL)
-			break;
+	if (search_in_include_path(filename)) {
+		for (i = 0; i < INCLUDE_PATHS_MAX; i++) {
+			if (include_paths[i] == NULL)
+				break;
+			snprintf(buf, sizeof(buf), "%s/%s",
+				 include_paths[i], filename);
+			f = fopen(buf, "r");
+			if (f != NULL)
+				break;
+		}
 	}
 	if (f == NULL) {
 		f = fopen(filename, "r");
-- 
2.1.4

[PATCH nft 2/3] scanner: don't fall back on current directory if include is not found

[Pablo Neira Ayuso]

This resolves an ambiguity if the same file name is used both under
sysconfdir and the current working directory.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1040
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/scanner.l | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/src/scanner.l b/src/scanner.l
index 6f1a551..cb2ea32 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -639,16 +639,15 @@ int scanner_include_file(void *scanner, const char *filename,
 			if (f != NULL)
 				break;
 		}
-	}
-	if (f == NULL) {
+	} else {
 		f = fopen(filename, "r");
-		if (f == NULL) {
-			erec = error(loc, "Could not open file \"%s\": %s\n",
-				     filename, strerror(errno));
-			goto err;
-		}
 		name = filename;
 	}
+	if (f == NULL) {
+		erec = error(loc, "Could not open file \"%s\": %s\n",
+			     filename, strerror(errno));
+		goto err;
+	}
 
 	erec = scanner_push_file(scanner, name, f, loc);
 	if (erec != NULL)
-- 
2.1.4

[PATCH nft 3/3] scanner: don't break line on include error message

[Pablo Neira Ayuso]

For consistency with other error messages in this codebase, don't add a
line break.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/scanner.l | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/scanner.l b/src/scanner.l
index cb2ea32..613c3c9 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -644,7 +644,7 @@ int scanner_include_file(void *scanner, const char *filename,
 		name = filename;
 	}
 	if (f == NULL) {
-		erec = error(loc, "Could not open file \"%s\": %s\n",
+		erec = error(loc, "Could not open file \"%s\": %s",
 			     filename, strerror(errno));
 		goto err;
 	}
-- 
2.1.4