From 98ebd01ddd335ad6d667007fa0439ca05a3855e2 Mon Sep 17 00:00:00 2001
From: Radostin Stoyanov <rstoyanov@fedoraproject.org>
Date: Fri, 5 Jan 2024 14:40:25 +0000
Subject: [PATCH] net: fix network unlock with iptables-nft

When iptables-nft is used as backend for iptables, the rules for
network locking are translated into the following nft rules:

```
$ iptables-restore-translate -f lock.txt
add table ip filter
add chain ip filter CRIU
insert rule ip filter INPUT counter jump CRIU
insert rule ip filter OUTPUT counter jump CRIU
add rule ip filter CRIU mark 0xc114 counter accept
add rule ip filter CRIU counter drop
```

These rules create the following chains:

```
table ip filter { # handle 1
	chain CRIU { # handle 1
		meta mark 0x0000c114 counter packets 16 bytes 890 accept # handle 6
		counter packets 1 bytes 60 drop # handle 7
		meta mark 0x0000c114 counter packets 0 bytes 0 accept # handle 8
		counter packets 0 bytes 0 drop # handle 9
	}

	chain INPUT { # handle 2
		type filter hook input priority filter; policy accept;
		counter packets 8 bytes 445 jump CRIU # handle 3
		counter packets 0 bytes 0 jump CRIU # handle 10
	}

	chain OUTPUT { # handle 4
		type filter hook output priority filter; policy accept;
		counter packets 9 bytes 505 jump CRIU # handle 5
		counter packets 0 bytes 0 jump CRIU # handle 11
	}
}
```

In order to delete the CRIU chain, we need to first delete all four
jump targets. Otherwise, `-X CRIU` would fail with the following error:

iptables-restore v1.8.10 (nf_tables):
line 5: CHAIN_DEL failed (Resource busy): chain CRIU

Reported-by: Andrei Vagin <avagin@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
---
 criu/include/util.h |  1 +
 criu/net.c          | 30 +++++++++++++++++++++++-------
 criu/util.c         |  2 +-
 3 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/criu/include/util.h b/criu/include/util.h
index 4334e69c2dc..43ec4c25986 100644
--- a/criu/include/util.h
+++ b/criu/include/util.h
@@ -170,6 +170,7 @@ extern pid_t fork_and_ptrace_attach(int (*child_setup)(void));
 extern int cr_daemon(int nochdir, int noclose, int close_fd);
 extern int status_ready(void);
 extern int is_root_user(void);
+extern int is_iptables_nft(char *bin);
 
 extern int set_proc_self_fd(int fd);
 
diff --git a/criu/net.c b/criu/net.c
index 7109e6876a0..20b67db01e8 100644
--- a/criu/net.c
+++ b/criu/net.c
@@ -3180,15 +3180,31 @@ static inline int nftables_network_unlock(void)
 
 static int iptables_network_unlock_internal(void)
 {
-	char conf[] = "*filter\n"
-		      ":CRIU - [0:0]\n"
-		      "-D INPUT -j CRIU\n"
-		      "-D OUTPUT -j CRIU\n"
-		      "-X CRIU\n"
-		      "COMMIT\n";
+	char legacy_rules[] = "*filter\n"
+				":CRIU - [0:0]\n"
+				"-D INPUT -j CRIU\n"
+				"-D OUTPUT -j CRIU\n"
+				"-X CRIU\n"
+				"COMMIT\n";
+
+	char nft_rules[] = "*filter\n"
+				":CRIU - [0:0]\n"
+				"-D INPUT -j CRIU\n"
+				"-D INPUT -j CRIU\n"
+				"-D OUTPUT -j CRIU\n"
+				"-D OUTPUT -j CRIU\n"
+				"-X CRIU\n"
+				"COMMIT\n";
 	int ret = 0;
+	int conf_size = sizeof(legacy_rules) - 1;
+	char *conf = legacy_rules;
 
-	ret |= iptables_restore(false, conf, sizeof(conf) - 1);
+	if (is_iptables_nft("iptables-restore") == 1) {
+		conf_size = sizeof(nft_rules) - 1;
+		conf = nft_rules;
+	}
+
+	ret |= iptables_restore(false, conf, conf_size);
 	if (kdat.ipv6)
 		ret |= iptables_restore(true, conf, sizeof(conf) - 1);
 
diff --git a/criu/util.c b/criu/util.c
index 95ba0feda64..f08353ea5b0 100644
--- a/criu/util.c
+++ b/criu/util.c
@@ -1637,7 +1637,7 @@ int cut_path_ending(char *path, char *ending)
 	return 0;
 }
 
-static int is_iptables_nft(char *bin)
+int is_iptables_nft(char *bin)
 {
 	int pfd[2] = { -1, -1 }, ret = -1;
 	char *cmd[] = { bin, "-V", NULL };