[iptables PATCH v2 3/3] iptables-save: Avoid /etc/protocols lookups

[Phil Sutter <phil@nwl.cc>]

Instrument proto_to_name() to abort if given protocol number is not
among the well-known ones in xtables_chain_protos. Along with
xtables_parse_protocol() preferring said array for lookups as well, this
ensures reliable dump'n'restore regardless of /etc/protocols contents.

Another benefit is rule dump performance. A simple test-case dumping
100k rules matching on dccp protocol shows an 8s delta (2s vs. 10s for
legacy, 0.5s vs. 8s for nft) with this patch applied. For reference:

| for variant in nft legacy; do
| 	(
| 		echo "*filter"
| 		for ((i = 0; i < 100000; i++)); do
| 		        echo "-A FORWARD -p dccp -j ACCEPT"
| 		done
| 		echo "COMMIT"
| 	) | iptables-${variant}-restore
| 	time iptables-${variant}-save | wc -l
| 	iptables-${variant} -F
| done

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/tests/shell/testcases/ipt-save/0001load-dumps_0 | 1 +
 iptables/xshared.c                                       | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/iptables/tests/shell/testcases/ipt-save/0001load-dumps_0 b/iptables/tests/shell/testcases/ipt-save/0001load-dumps_0
index 4e0be51c071c8..48f5f7b423379 100755
--- a/iptables/tests/shell/testcases/ipt-save/0001load-dumps_0
+++ b/iptables/tests/shell/testcases/ipt-save/0001load-dumps_0
@@ -39,6 +39,7 @@ do_simple()
 
 	$XT_MULTI ${iptables}-restore < "$dumpfile"
 	$XT_MULTI ${iptables}-save | grep -v "^#" > "$tmpfile"
+	sed -i -e 's/-p 47 /-p gre /' "$tmpfile"
 	do_diff $dumpfile "$tmpfile"
 	if [ $? -ne 0 ]; then
 		# cp "$tmpfile" "$dumpfile.got"
diff --git a/iptables/xshared.c b/iptables/xshared.c
index 68f70277388a6..51283d7afad1e 100644
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -1097,7 +1097,7 @@ void save_rule_details(const char *iniface, const char *outiface,
 	}
 
 	if (proto > 0) {
-		const char *pname = proto_to_name(proto, 0);
+		const char *pname = proto_to_name(proto, true);
 
 		if (invflags & XT_INV_PROTO)
 			printf(" !");
-- 
2.43.0