iptables: introduce /sbin compatibility symlinks

To be dropped in the buster+1 release cycles, so we don't break people
hardcoding the path to iptables.

Closes: #911777
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>

debian/NEWS

+iptables (1.8.1-2) unstable; urgency=medium
+
+    All the iptables binaries has been moved away from /sbin to /usr/sbin.
+    Some compatibility symlinks have ben added for the Buster release cycle,
+    but please make sure your scripts aren't using hardcoded binary paths.
+    The plan after Buster is to drop the symlinks.
+
+ -- Arturo Borrero Gonzalez <arturo@debian.org>  Wed,  25 Oct 2018 12:00:00 +0200
+
 iptables (1.8.1-1) unstable; urgency=medium
 
     By default, this package will try to use the nf_tables kernel backend

debian/iptables.postinst

@@ -2,6 +2,22 @@
 
 set -e
 
+# compat symlinks for /sbin -> /usr/sbin move, to be dropped in buster+1
+if [ "$1" = "configure" ] ; then
+	LIST="/sbin/iptables
+	      /sbin/iptables-save
+	      /sbin/iptables-restore
+	      /sbin/ip6tables
+              /sbin/ip6tables-save
+              /sbin/ip6tables-restore"
+
+	for i in $LIST ; do
+		if [ ! -e "$i" ] ; then
+			ln -s /usr$i $i
+		fi
+	done
+fi
+
 if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ]; then
 	update-alternatives \
 	  --install /usr/sbin/iptables iptables /usr/sbin/iptables-legacy 10 \

debian/iptables.prerm

@@ -2,6 +2,22 @@
 
 set -e
 
+# compat symlinks for /sbin -> /usr/sbin move, to be dropped in buster+1
+if [ "$1" = "remove" ] ; then
+	LIST="/sbin/iptables
+	     /sbin/iptables-save
+	     /sbin/iptables-restore
+	     /sbin/ip6tables
+	     /sbin/ip6tables-save
+	     /sbin/ip6tables-restore"
+
+	for i in $LIST ; do
+		if [ -L "$i" ] ; then
+			rm $i
+		fi
+	done
+fi
+
 if [ "$1" != "upgrade" ]; then
     update-alternatives --remove iptables /usr/sbin/iptables-legacy
     update-alternatives --remove ip6tables /usr/sbin/ip6tables-legacy