use nf_tables and nf_tables compatibility interface

This patch adds the following utilities:

* xtables
* xtables-restore
* xtables-save
* xtables-config

They all use Patrick's nf_tables infrastructure plus my compatibility
layer.

xtables, xtables-restore and xtables-save are syntax compatible with
ip[6]tables, ip[6]tables-restore and ip[6]tables-save.

Semantics aims to be similar, still the main exception is that there
is no commit operation. Thus, we incrementally add/delete rules without
entire table locking.

The following options are also not yet implemented:

-Z (this requires adding expr->ops->reset(...) so nft_counters can reset
    internal state of expressions while dumping it)

-R and -E (this requires adding this feature to nf_tables)

-f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0)

-IPv6 support.

But those are a matter of time to get them done.

A new utility, xtables-config, is available to register tables and
chains. By default there is a configuration file that adds backward
compatible tables and chains under iptables/etc/xtables.conf. You have
to call this utility first to register tables and chains.

However, it would be possible to automagically register tables and
chains while using xtables and xtables-restore to get similar operation
than with iptables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
automatic creation of built-in table and chains

In order to emulate the iptables behaviour, this patch changes
the current behaviour to:

1st) check if the table and chains are built-in.
2nd) If they don't exists, create them. If they exists, don't touch
     them.

The automatic creation happens in the -I and -P paths.

We should provide a new command to allow to delete (unregister)
built-in tables and chains. It would be similar to unloading
the iptable_X module that registers the custom table.

This is not done for other commands like -C or -D since they
will fail while trying to find the rule in the kernel if such
combination of chain and table does not exists.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
rework automatic creation of built-in table and chains

This patch reworks the automatic creation of built-in table and
chains. Now it initializes all built-in chains belonging a table
at once.

This happens with commands: -P, -A, -I, -N

Note that xtables skips chain initialization if it notices that
the table already exists in the kernel.

Thanks to Tomasz Bursztyka for spotting problems with -N.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: nft: add -f support

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
headers: Make nf_tables.h up to date

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
nft: Add support for chain rename options (-E)

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
iptables: nft: Fix -D chain rulenum option

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
iptables: nft: Refactor __nft_rule_check to return rule handle when relevant

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
iptables: nft: Add support for -R option

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
nft: fix missing rule listing in custom chains with -L

Reported-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
headers: remove unused compatibility definitions

They belong to nf_tables_compat.h

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: nft: move priority to chain instead of table

NAT table uses different chain priorities, adapt the existing
code to allow this.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: nft: remove __nft_check_rule

Rework code to remove __nft_check_rule and split it into
logical fragments.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: nft: use 64-bits handle

Now that we use that in kernel space and in libnftables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: nft: use chain types

We use the new special chain types defined in the kernel.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
xtables-restore: add support for dormant tables

This patch adds support for dormant tables for xtables-restore.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft: adapt chain rename to recent Patrick's updates

This patch gets existing code in sync with Patrick's chain
renaming new approach.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
xtables: fix crash due to using wrong globals

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
xtables: add IPv6 support

Summary of changes to add IPv6 support to the xtables utility:

* modify all commands (add, delete, replace, check and listing) to
  support IPv6 addresses.

And for the internal nft library:

* add family to struct nft_handle and modify all caller to use this
  family instead of the hardcoded AF_INET.
* move code that we can re-use for IPv4 and IPv6 into helper functions.
* add IPv6 rule printing support.
* add support to parse IPv6 address.

Pablo added several improvements to this patch:

* added basic xtables-save and xtables-restore support (so it defaults
  to IPv4)
* fixed a couple of bugs found while testing
* added reference when -f is used to point to -m frag (until we can make
  this consistent with IPv4).

Note that we use one single xtables binary utility for IPv4 and IPv6.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
xtables-restore: fix custom user chain restoration

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>