xtables: Add backward compatibility with -w option

Just to keep aligned with iptables legacy tool.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft: adds save_matches_and_target

This patch permits to save matches and target for ip/ip6/arp/eb
family, required for xtables-events.

Also, generalizes nft_rule_print_save to be reused for all protocol
families.

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft-compat: fix IP6T_F_GOTO flag handling

IPT_F_GOTO and IP6T_F_GOTO don't overlap, so this need special handling
to avoid misinterpretations.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft-compat: fix wrong protocol context in initialization

This fixes matches/targets that are dependent on that IPv4/Ipv6
context, eg.

 # ip6tables-compat -I INPUT -j REJECT --reject-with icmp6-addr-unreachable
 # ip6tables-compat-save
 ...
 -A INPUT -j REJECT --reject-with icmp6-port-unreachable

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft: Add useful debug output when a builtin table is created

This is useful to know if a builtin table is requested to be created.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft: A builtin chain might be created when restoring

nft_chain_set() is directly used in xtables-restore.c, however at that
point no builtin chains have been created yet thus the need to request
to build it relevantly.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft: Initialize a table only once

This helps to remove some runtime overhead, especially when running
xtables-restore.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft: Remove useless error message

These are not helpful.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft: Pass a line after printing out a debug message

In this specific places, libnftnl gives back a string on which iptables
should not assume any line break, thus it's up to iptables to add it.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>