iptables: improve chain name validation

As pointed out by Andrew Domaszek, iptables allows whitespace to be included in
chain names.  This causes issues with iptables-restore, and later iptables
actions on the chain.  Attached patch disallows whitespace, and also consolidates
all chain name checking into a new function.

This closes netfilter bugzilla #855.

[ Included ip6tables changed as well --pablo ]

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: spurious error in load_extension

In commit 927385017047d (iptables: improve error reporting with extension
loading troubles), a new error message was added in an attempt to handle
the case where a match does not support a particular protocol family.
For instance, attempting to use the osf match on IPv6.

Unfortunately, this error message now triggers when creating a new chain
which has the same name as a match extension, because iptables calls
xtables_find_target with the name of the new chain to verify it does not
clash with an existing target.  For example:

    # iptables -N tcp
    /usr/lib/xtables/libxt_tcp.so: no "tcp" extension found for this protocol

I attempted to resolve this by adding a new XTF flag, but that required changes
in many different places (including -j handling).  It seems easiest just to
remove this warning and stick with the original error message of ENOENT, even
if less than precise.

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
ip6tables: Use consistent exit code for EAGAIN

As of commit 056564f6a (Add new exit value to indicate concurrency
issues), the IPv4 iptables binary returns exit status 4 to indicate that
the kernel returned EAGAIN when trying to update a table.  But ip6tables
still returns exit status 1 under the same circumstances.  Update
ip6tables to bring it in line with iptables behavior.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_cluster: add note on arptables-jf

Gao feng reported problems while getting the cluster match working with
arptables. This patch adds a note in the manpage to warn about the arptables-jf
syntax, which is different from mainstream arptables.

Reported-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>