xtables: add xtables-compat-multi for the nftables compatibility layer

This patch should allow distributors to switch to the iptables over
nftables compatibility layer in a transparent way by updating
symbolic links from:

lrwxrwxrwx  1 root    root         13 feb  4 15:35 iptables -> xtables-multi

to:

lrwxrwxrwx  1 root    root         13 feb  4 15:35 iptables -> xtables-compat-multi

Same thing with iptables-save, iptables-restore, ip6tables, ip6tables-save,
ip6tables-restore and arptables.

Note that, after this patch, the following new symlinks are installed:

* iptables-compat
* iptables-compat-save
* iptables-compat-restore
* ip6tables-compat
* ip6tables-compat-save
* ip6tables-compat-restore
* arptables-compat

which point to the new binary xtables-compat-multi.

The idea is to keep both native and compatibility tools installed in the
system, which should also make it easier for testing purposes.

The iptables over nftables compatibility layer is enabled by default
and it requires the libmnl and libnftnl libraries. If you don't want to
compile the compatibility layer, you can still disable it through
--disable-nftables.

This patch also includes changes to adapt the existing code to this
approach.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 17 insertions, 5 deletions

diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index 230894cd..c4af2c5d 100644
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -165,11 +165,11 @@ static const struct xtc_ops xtc_ops = {
 	.strerror	= nft_strerror,
 };
 
-int
-xtables_restore_main(int argc, char *argv[])
+static int
+xtables_restore_main(int family, const char *progname, int argc, char *argv[])
 {
 	struct nft_handle h = {
-		.family = AF_INET,	/* default to IPv4 */
+		.family = family,
 	};
 	char buffer[10240];
 	int c;
@@ -183,8 +183,8 @@ xtables_restore_main(int argc, char *argv[])
 
 	line = 0;
 
-	xtables_globals.program_name = "xtables-restore";
-	c = xtables_init_all(&xtables_globals, NFPROTO_IPV4);
+	xtables_globals.program_name = progname;
+	c = xtables_init_all(&xtables_globals, family);
 	if (c < 0) {
 		fprintf(stderr, "%s/%s Failed to initialize xtables\n",
 				xtables_globals.program_name,
@@ -472,3 +472,15 @@ xtables_restore_main(int argc, char *argv[])
 	fclose(in);
 	return 0;
 }
+
+int xtables_ip4_restore_main(int argc, char *argv[])
+{
+	return xtables_restore_main(NFPROTO_IPV4, "iptables-restore",
+				    argc, argv);
+}
+
+int xtables_ip6_restore_main(int argc, char *argv[])
+{
+	return xtables_restore_main(NFPROTO_IPV6, "ip6tables-restore",
+				    argc, argv);
+}