use nf_tables and nf_tables compatibility interface

This patch adds the following utilities:

* xtables
* xtables-restore
* xtables-save
* xtables-config

They all use Patrick's nf_tables infrastructure plus my compatibility
layer.

xtables, xtables-restore and xtables-save are syntax compatible with
ip[6]tables, ip[6]tables-restore and ip[6]tables-save.

Semantics aims to be similar, still the main exception is that there
is no commit operation. Thus, we incrementally add/delete rules without
entire table locking.

The following options are also not yet implemented:

-Z (this requires adding expr->ops->reset(...) so nft_counters can reset
    internal state of expressions while dumping it)

-R and -E (this requires adding this feature to nf_tables)

-f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0)

-IPv6 support.

But those are a matter of time to get them done.

A new utility, xtables-config, is available to register tables and
chains. By default there is a configuration file that adds backward
compatible tables and chains under iptables/etc/xtables.conf. You have
to call this utility first to register tables and chains.

However, it would be possible to automagically register tables and
chains while using xtables and xtables-restore to get similar operation
than with iptables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 24 insertions, 0 deletions

diff --git a/etc/xtables.conf b/etc/xtables.conf
new file mode 100644
index 00000000..00b5df4f
--- /dev/null
+++ b/etc/xtables.conf
@@ -0,0 +1,24 @@
+table raw prio -300 {
+	chain PREROUTING hook NF_INET_PRE_ROUTING
+	chain OUTPUT hook NF_INET_LOCAL_OUT
+}
+
+table mangle prio -150 {
+	chain PREROUTING hook NF_INET_PRE_ROUTING
+	chain INPUT hook NF_INET_LOCAL_IN
+	chain FORWARD hook NF_INET_FORWARD
+	chain OUTPUT hook NF_INET_LOCAL_OUT
+	chain POSTROUTING hook NF_INET_POST_ROUTING
+}
+
+table filter prio 0 {
+	chain INPUT hook NF_INET_LOCAL_IN
+	chain FORWARD hook NF_INET_FORWARD
+	chain OUTPUT hook NF_INET_LOCAL_OUT
+}
+
+table security prio 150 {
+	chain INPUT hook NF_INET_LOCAL_IN
+	chain FORWARD hook NF_INET_FORWARD
+	chain OUTPUT hook NF_INET_LOCAL_OUT
+}