[hky1999]

Series #17025, PR 2/3, stacked on #17026. Related: #16670, #4595.

Preserve legacy iptables rules and conntrack together so restored Docker networking retains filtering and NAT state. Restore matcher/target state, rebind stack-dependent references, rehash original/reply tuples, and retain saved tables during destination configuration. This contributes AKernel's independently developed downstream implementation.

Two minimal dataplane regressions accompany this commit:

• FilterDropAndRemovalAcrossSave: UDP passes initially, is dropped after installing INPUT DROP, remains blocked after restore, and passes after rule removal.
• EstablishedDNATMappingAcrossSaveWithoutMatchingRule: establish a bidirectional IPv4 UDP address/port mapping, replace its matching rule with a nonmatching rule, then save. The original sockets must work after restore, while a fresh tuple must not inherit the mapping. Replaying rules cannot reconstruct the original flow and hide missing conntrack state.

Validation at ee441833bcd6eed16ae63daf31a53a4024f3ee2c on frozen master deb6b3ea1355ea9798c043cf33bc02804e86ed53: both cases pass native Linux and netfilter-prefix systrap ordinary/save/save-resume, without skips. On the topology-only prefix, both reach restore and fail the post-restore dataplane checks. These tests do not require #16666. The complete release builds; source lint and changed-source C++ lint pass. The baseline full-lint limitation is recorded in #17025.

Run with CAP_NET_ADMIN, CAP_SYS_ADMIN and CAP_NET_RAW; both cases must execute without skips:

bazel test -c opt \
  //test/syscalls:iptables_test_native \
  //test/syscalls:iptables_test_runsc_systrap_save \
  //test/syscalls:iptables_test_runsc_systrap_save_resume \
  --test_env='GTEST_FILTER=IPTablesCheckpointTest.*' \
  --test_output=all --nocache_test_results

Scope: legacy iptables. Existing TCP NAT, broader SNAT/target coverage, expiry, restore-time readiness, failure cleanup and performance remain to be qualified in #17025. The combined DinD TCP fixture applies #16666 separately.

Compatibility: COMPATIBILITY:NEW-APP-CONFIG — runtime-programmed legacy networking with sandbox C/R.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.