net: fix network unlock with iptables-nft

When iptables-nft is used as backend for iptables, the rules for
network locking are translated into the following nft rules:

```
$ iptables-restore-translate -f lock.txt
add table ip filter
add chain ip filter CRIU
insert rule ip filter INPUT counter jump CRIU
insert rule ip filter OUTPUT counter jump CRIU
add rule ip filter CRIU mark 0xc114 counter accept
add rule ip filter CRIU counter drop
```

These rules create the following chains:

```
table ip filter { # handle 1
	chain CRIU { # handle 1
		meta mark 0x0000c114 counter packets 16 bytes 890 accept # handle 6
		counter packets 1 bytes 60 drop # handle 7
		meta mark 0x0000c114 counter packets 0 bytes 0 accept # handle 8
		counter packets 0 bytes 0 drop # handle 9
	}

	chain INPUT { # handle 2
		type filter hook input priority filter; policy accept;
		counter packets 8 bytes 445 jump CRIU # handle 3
		counter packets 0 bytes 0 jump CRIU # handle 10
	}

	chain OUTPUT { # handle 4
		type filter hook output priority filter; policy accept;
		counter packets 9 bytes 505 jump CRIU # handle 5
		counter packets 0 bytes 0 jump CRIU # handle 11
	}
}
```

In order to delete the CRIU chain, we need to first delete all four
jump targets. Otherwise, `-X CRIU` would fail with the following error:

iptables-restore v1.8.10 (nf_tables):
line 5: CHAIN_DEL failed (Resource busy): chain CRIU

Reported-by: Andrei Vagin <avagin@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>

criu/include/util.h

@@ -170,6 +170,7 @@ extern pid_t fork_and_ptrace_attach(int (*child_setup)(void));
 extern int cr_daemon(int nochdir, int noclose, int close_fd);
 extern int status_ready(void);
 extern int is_root_user(void);
+extern int is_iptables_nft(char *bin);
 
 extern int set_proc_self_fd(int fd);
 

criu/net.c

@@ -3180,15 +3180,31 @@ static inline int nftables_network_unlock(void)
 
 static int iptables_network_unlock_internal(void)
 {
-	char conf[] = "*filter\n"
-		      ":CRIU - [0:0]\n"
-		      "-D INPUT -j CRIU\n"
-		      "-D OUTPUT -j CRIU\n"
-		      "-X CRIU\n"
-		      "COMMIT\n";
+	char legacy_rules[] = "*filter\n"
+				":CRIU - [0:0]\n"
+				"-D INPUT -j CRIU\n"
+				"-D OUTPUT -j CRIU\n"
+				"-X CRIU\n"
+				"COMMIT\n";
+
+	char nft_rules[] = "*filter\n"
+				":CRIU - [0:0]\n"
+				"-D INPUT -j CRIU\n"
+				"-D INPUT -j CRIU\n"
+				"-D OUTPUT -j CRIU\n"
+				"-D OUTPUT -j CRIU\n"
+				"-X CRIU\n"
+				"COMMIT\n";
 	int ret = 0;
+	int conf_size = sizeof(legacy_rules) - 1;
+	char *conf = legacy_rules;
 
-	ret |= iptables_restore(false, conf, sizeof(conf) - 1);
+	if (is_iptables_nft("iptables-restore") == 1) {
+		conf_size = sizeof(nft_rules) - 1;
+		conf = nft_rules;
+	}
+
+	ret |= iptables_restore(false, conf, conf_size);
 	if (kdat.ipv6)
 		ret |= iptables_restore(true, conf, sizeof(conf) - 1);
 

criu/util.c

@@ -1637,7 +1637,7 @@ int cut_path_ending(char *path, char *ending)
 	return 0;
 }
 
-static int is_iptables_nft(char *bin)
+int is_iptables_nft(char *bin)
 {
 	int pfd[2] = { -1, -1 }, ret = -1;
 	char *cmd[] = { bin, "-V", NULL };