From 5fac849eac7ecfde4ca6f9c9c406ace030f358f2 Mon Sep 17 00:00:00 2001

From: Phil Sutter <psutter@redhat.com>

Date: Fri, 10 Jan 2020 19:54:16 +0100

Subject: [PATCH] main: enforce options before commands

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1778883

Upstream Status: nftables commit fb9cea50e8b37

commit fb9cea50e8b370b6931e7b53b1a881d3b95b1c91

Author: Pablo Neira Ayuso <pablo@netfilter.org>

Date:   Fri Dec 13 11:32:46 2019 +0100

    main: enforce options before commands

    This patch turns on POSIXLY_CORRECT on the getopt parser to enforce

    options before commands. Users get a hint in such a case:

     # nft list ruleset -a

     Error: syntax error, options must be specified before commands

     nft list ruleset -a

        ^             ~~

    This patch recovers 9fc71bc6b602 ("main: Fix for misleading error with

    negative chain priority").

    Tests have been updated.

    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

---

 src/main.c                                    | 46 ++++++++++++++++++-

 .../testcases/cache/0001_cache_handling_0     |  2 +-

 .../testcases/chains/0016delete_handle_0      |  4 +-

 .../testcases/chains/0039negative_priority_0  |  8 ++++

 .../testcases/flowtable/0010delete_handle_0   |  2 +-

 .../testcases/maps/0008interval_map_delete_0  |  2 +-

 tests/shell/testcases/optionals/comments_0    |  2 +-

 .../testcases/optionals/comments_handles_0    |  2 +-

 .../optionals/delete_object_handles_0         |  4 +-

 tests/shell/testcases/optionals/handles_0     |  2 +-

 .../shell/testcases/sets/0028delete_handle_0  |  2 +-

 11 files changed, 64 insertions(+), 12 deletions(-)

 create mode 100755 tests/shell/testcases/chains/0039negative_priority_0

diff --git a/src/main.c b/src/main.c

index fde8b15..74199f9 100644

--- a/src/main.c

+++ b/src/main.c

@@ -46,7 +46,7 @@ enum opt_vals {

 	OPT_TERSE		= 't',

 	OPT_INVALID		= '?',

 };

-#define OPTSTRING	"hvcf:iI:jvnsNaeSupypTt"

+#define OPTSTRING	"+hvcf:iI:jvnsNaeSupypTt"

 static const struct option options[] = {

 	{

@@ -202,6 +202,47 @@ static const struct {

 	},

 };

+static void nft_options_error(int argc, char * const argv[], int pos)

+{

+	int i;

+

+	fprintf(stderr, "Error: syntax error, options must be specified before commands\n");

+	for (i = 0; i < argc; i++)

+		fprintf(stderr, "%s ", argv[i]);

+	printf("\n%4c%*s\n", '^', pos - 2, "~~");

+}

+

+static bool nft_options_check(int argc, char * const argv[])

+{

+	bool skip = false, nonoption = false;

+	int pos = 0, i;

+

+	for (i = 1; i < argc; i++) {

+		pos += strlen(argv[i - 1]) + 1;

+		if (argv[i][0] == '{') {

+			break;

+		} else if (skip) {

+			skip = false;

+			continue;

+		} else if (argv[i][0] == '-') {

+			if (nonoption) {

+				nft_options_error(argc, argv, pos);

+				return false;

+			} else if (argv[i][1] == 'I' ||

+				   argv[i][1] == 'f' ||

+				   !strcmp(argv[i], "--includepath") ||

+				   !strcmp(argv[i], "--file")) {

+				skip = true;

+				continue;

+			}

+		} else if (argv[i][0] != '-') {

+			nonoption = true;

+		}

+	}

+

+	return true;

+}

+

 int main(int argc, char * const *argv)

 {

 	char *buf = NULL, *filename = NULL;

@@ -211,6 +252,9 @@ int main(int argc, char * const *argv)

 	unsigned int len;

 	int i, val, rc;

+	if (!nft_options_check(argc, argv))

+		exit(EXIT_FAILURE);

+

 	nft = nft_ctx_new(NFT_CTX_DEFAULT);

 	while (1) {

diff --git a/tests/shell/testcases/cache/0001_cache_handling_0 b/tests/shell/testcases/cache/0001_cache_handling_0

index 431aada..0a68440 100755

--- a/tests/shell/testcases/cache/0001_cache_handling_0

+++ b/tests/shell/testcases/cache/0001_cache_handling_0

@@ -20,7 +20,7 @@ TMP=$(mktemp)

 echo "$RULESET" >> "$TMP"

 $NFT "flush ruleset;include \"$TMP\""

 rm -f "$TMP"

-rule_handle=$($NFT list ruleset -a | awk '/saddr/{print $NF}')

+rule_handle=$($NFT -a list ruleset | awk '/saddr/{print $NF}')

 $NFT delete rule inet test test handle $rule_handle

 $NFT delete set inet test test

 $NFT -f - <<< "$RULESET"

diff --git a/tests/shell/testcases/chains/0016delete_handle_0 b/tests/shell/testcases/chains/0016delete_handle_0

index 4633d77..8fd1ad8 100755

--- a/tests/shell/testcases/chains/0016delete_handle_0

+++ b/tests/shell/testcases/chains/0016delete_handle_0

@@ -10,8 +10,8 @@ $NFT add chain ip6 test-ip6 x

 $NFT add chain ip6 test-ip6 y

 $NFT add chain ip6 test-ip6 z

-chain_y_handle=$($NFT list ruleset -a | awk -v n=1 '/chain y/ && !--n {print $NF; exit}');

-chain_z_handle=$($NFT list ruleset -a | awk -v n=2 '/chain z/ && !--n {print $NF; exit}');

+chain_y_handle=$($NFT -a list ruleset | awk -v n=1 '/chain y/ && !--n {print $NF; exit}');

+chain_z_handle=$($NFT -a list ruleset | awk -v n=2 '/chain z/ && !--n {print $NF; exit}');

 $NFT delete chain test-ip handle $chain_y_handle

 $NFT delete chain ip6 test-ip6 handle $chain_z_handle

diff --git a/tests/shell/testcases/chains/0039negative_priority_0 b/tests/shell/testcases/chains/0039negative_priority_0

new file mode 100755

index 0000000..ba17b8c

--- /dev/null

+++ b/tests/shell/testcases/chains/0039negative_priority_0

@@ -0,0 +1,8 @@

+#!/bin/bash

+

+# Test parsing of negative priority values

+

+set -e

+

+$NFT add table t

+$NFT add chain t c { type filter hook input priority -30\; }

diff --git a/tests/shell/testcases/flowtable/0010delete_handle_0 b/tests/shell/testcases/flowtable/0010delete_handle_0

index 303967d..985d4a3 100755

--- a/tests/shell/testcases/flowtable/0010delete_handle_0

+++ b/tests/shell/testcases/flowtable/0010delete_handle_0

@@ -7,7 +7,7 @@ set -e

 $NFT add table inet t

 $NFT add flowtable inet t f { hook ingress priority filter\; devices = { lo }\; }

-FH=$($NFT list ruleset -a | awk '/flowtable f/ { print $NF }')

+FH=$($NFT -a list ruleset | awk '/flowtable f/ { print $NF }')

 $NFT delete flowtable inet t handle $FH

diff --git a/tests/shell/testcases/maps/0008interval_map_delete_0 b/tests/shell/testcases/maps/0008interval_map_delete_0

index a43fd28..7da6eb3 100755

--- a/tests/shell/testcases/maps/0008interval_map_delete_0

+++ b/tests/shell/testcases/maps/0008interval_map_delete_0

@@ -24,7 +24,7 @@ $NFT delete element filter m { 127.0.0.3 }

 $NFT add element filter m { 127.0.0.3 : 0x3 }

 $NFT add element filter m { 127.0.0.2 : 0x2 }

-GET=$($NFT list ruleset -s)

+GET=$($NFT -s list ruleset)

 if [ "$EXPECTED" != "$GET" ] ; then

 	DIFF="$(which diff)"

 	[ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")

diff --git a/tests/shell/testcases/optionals/comments_0 b/tests/shell/testcases/optionals/comments_0

index 29b8506..ab85936 100755

--- a/tests/shell/testcases/optionals/comments_0

+++ b/tests/shell/testcases/optionals/comments_0

@@ -5,4 +5,4 @@

 $NFT add table test

 $NFT add chain test test

 $NFT add rule test test tcp dport 22 counter accept comment test_comment

-$NFT list table test -a | grep 'accept comment \"test_comment\"' >/dev/null

+$NFT -a list table test | grep 'accept comment \"test_comment\"' >/dev/null

diff --git a/tests/shell/testcases/optionals/comments_handles_0 b/tests/shell/testcases/optionals/comments_handles_0

index 30539bf..a01df1d 100755

--- a/tests/shell/testcases/optionals/comments_handles_0

+++ b/tests/shell/testcases/optionals/comments_handles_0

@@ -6,5 +6,5 @@ $NFT add table test

 $NFT add chain test test

 $NFT add rule test test tcp dport 22 counter accept comment test_comment

 set -e

-$NFT list table test -a | grep 'accept comment \"test_comment\" # handle '[[:digit:]]$ >/dev/null

+$NFT -a list table test | grep 'accept comment \"test_comment\" # handle '[[:digit:]]$ >/dev/null

 $NFT list table test | grep 'accept comment \"test_comment\"' | grep -v '# handle '[[:digit:]]$ >/dev/null

diff --git a/tests/shell/testcases/optionals/delete_object_handles_0 b/tests/shell/testcases/optionals/delete_object_handles_0

index d5d9654..a2ae422 100755

--- a/tests/shell/testcases/optionals/delete_object_handles_0

+++ b/tests/shell/testcases/optionals/delete_object_handles_0

@@ -10,8 +10,8 @@ $NFT add quota ip6 test-ip6 http-quota over 25 mbytes

 $NFT add counter ip6 test-ip6 http-traffic

 $NFT add quota ip6 test-ip6 ssh-quota 10 mbytes

-counter_handle=$($NFT list ruleset -a | awk '/https-traffic/{print $NF}')

-quota_handle=$($NFT list ruleset -a | awk '/ssh-quota/{print $NF}')

+counter_handle=$($NFT -a list ruleset | awk '/https-traffic/{print $NF}')

+quota_handle=$($NFT -a list ruleset | awk '/ssh-quota/{print $NF}')

 $NFT delete counter test-ip handle $counter_handle

 $NFT delete quota ip6 test-ip6 handle $quota_handle

diff --git a/tests/shell/testcases/optionals/handles_0 b/tests/shell/testcases/optionals/handles_0

index 7c6a437..80f3c5b 100755

--- a/tests/shell/testcases/optionals/handles_0

+++ b/tests/shell/testcases/optionals/handles_0

@@ -5,4 +5,4 @@

 $NFT add table test

 $NFT add chain test test

 $NFT add rule test test tcp dport 22 counter accept

-$NFT list table test -a | grep 'accept # handle '[[:digit:]]$ >/dev/null

+$NFT -a list table test | grep 'accept # handle '[[:digit:]]$ >/dev/null

diff --git a/tests/shell/testcases/sets/0028delete_handle_0 b/tests/shell/testcases/sets/0028delete_handle_0

index 4e8b322..5ad17c2 100755

--- a/tests/shell/testcases/sets/0028delete_handle_0

+++ b/tests/shell/testcases/sets/0028delete_handle_0

@@ -7,7 +7,7 @@ $NFT add set test-ip y { type inet_service \; timeout 3h45s \;}

 $NFT add set test-ip z { type ipv4_addr\; flags constant , interval\;}

 $NFT add set test-ip c {type ipv4_addr \; flags timeout \; elements={192.168.1.1 timeout 10s, 192.168.1.2 timeout 30s} \;}

-set_handle=$($NFT list ruleset -a | awk '/set c/{print $NF}')

+set_handle=$($NFT -a list ruleset | awk '/set c/{print $NF}')

 $NFT delete set test-ip handle $set_handle

 EXPECTED="table ip test-ip {

-- 

2.31.1