iptables: nft: generalize batch infrastructure

Prepare inclusion of tables and chain objects in the batch.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: nft: remove unused code

Remove code to set table in dormant state, this is not required from
the iptables over nft compatibility layer.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: nft: add tables and chains to the batch

Since kernel changes:

55dd6f9 ("netfilter: nf_tables: use new transaction infrastructure
to handle table").
91c7b38 ("netfilter: nf_tables: use new transaction infrastructure
to handle chain").

it is possible to put tables and chains in the same batch (which was
already including rules). This patch probes the kernel to check if
if the new transaction is available, otherwise it falls back to the
previous non-transactional approach to handle these two objects.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nft: save: fix the printing of the counters

This patch prints the counters of a rule before the details,
like iptables-save syntax.

Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
libxtables: fix getaddrinfo return value usage

getaddrinfo return value on error can also be positive.

On Android they're positive, e.g.:

 android-ndk-r9d/platforms/android-19/arch-arm/usr/include/netdb.h
 147 #define EAI_NONAME       8      /* hostname nor servname provided, or not known */

And as a plus, it's not bad to conform to specs.

Signed-off-by: Domen Puncer Kugler <domen.puncer@samsung.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Makefile: fix static compilation iptables-compat without shared libraries

Fix linking problems when this configuration is used:

 $ ./configure --prefix=/usr --enable-shared=no --enable-static=yes
 $ make
 ...
xtables_compat_multi-xtables-save.o: In function `xtables_save_main':
/home/pablo/devel/iptables/iptables/xtables-save.c:98: undefined reference to `init_extensions4'
xtables_compat_multi-xtables-restore.o: In function `xtables_restore_main':
/home/pablo/devel/iptables/iptables/xtables-restore.c:195: undefined reference to `init_extensions4'
xtables_compat_multi-xtables-standalone.o: In function `xtables_main':
/home/pablo/devel/iptables/iptables/xtables-standalone.c:61: undefined reference to `init_extensions4'
xtables_compat_multi-xtables-events.o: In function `xtables_events_main':
/home/pablo/devel/iptables/iptables/xtables-events.c:184: undefined reference to `init_extensions4'

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: add optional [seconds] argument to -w

This patch adds an optional numeric argument
to -w option (added with 93587a0) so one can
specify how long to wait for an exclusive lock.

If the value isn't specified it works as before,
i.e. program waits indefinitely.

If user specifies it, program exits after
the given time interval passes.

This patch also adds the -w/--wait to nftables
compat code, so the parser doesn't complain.

[ In the original patch, iptables-compat -w X was not working,
  I have fixed by adding the dummy code not to break scripts
  using the new optional argument --pablo ]

Signed-off-by: Jiri Popelka <jpopelka@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>