[PATCH net-next,RFC 5/8] netfilter: nf_tables: add early ingress chain

[Pablo Neira Ayuso <pablo@netfilter.org>]

Add a new filter chain to filter out packets from the early_ingress hook.

This is the second user of this new hook, after the flowtable.

Co-developed-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_chain_filter.c | 116 ++++++++++++++++++++++++++++++-
 1 file changed, 114 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 47a612bdd03e..3467f7b7bd38 100644
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -210,17 +210,75 @@ static unsigned int nft_do_chain_inet_ingress(void *priv, struct sk_buff *skb,
 	return nft_do_chain(&pkt, priv);
 }
 
+static unsigned int
+nft_do_chain_inet_early_ingress(void *priv, struct sk_buff *unused,
+				const struct nf_hook_state *state)
+{
+	struct nf_hook_state ingress_state = *state;
+	struct sk_buff *skb, *nskb;
+	struct nft_pktinfo pkt;
+	LIST_HEAD(accept_list);
+	int ret;
+
+	list_for_each_entry_safe(skb, nskb, state->skb_list, list) {
+		skb_list_del_init(skb);
+
+		skb_reset_network_header(skb);
+		if (!skb_transport_header_was_set(skb))
+			skb_reset_transport_header(skb);
+		skb_reset_mac_len(skb);
+
+		ret = nft_set_pktinfo_ingress(&pkt, skb, &ingress_state);
+		switch (ret) {
+		case 1:
+			list_add_tail(&skb->list, &accept_list);
+			continue;
+		case 0:
+			break;
+		case -1:
+			kfree_skb(skb);
+			continue;
+		default:
+			break;
+		}
+
+		ret = nft_do_chain(&pkt, priv);
+		switch (ret) {
+		case NF_ACCEPT:
+			list_add_tail(&skb->list, &accept_list);
+			break;
+		default:
+			WARN_ON_ONCE(1);
+			fallthrough;
+		case NF_DROP:
+			kfree_skb(skb);
+			break;
+		}
+	}
+
+	WARN_ON_ONCE(!list_empty(state->skb_list));
+
+	list_splice(&accept_list, state->skb_list);
+
+	if (list_empty(state->skb_list))
+		return NF_STOLEN;
+
+	return NF_ACCEPT;
+}
+
 static const struct nft_chain_type nft_chain_filter_inet = {
 	.name		= "filter",
 	.type		= NFT_CHAIN_T_DEFAULT,
 	.family		= NFPROTO_INET,
-	.hook_mask	= (1 << NF_INET_INGRESS) |
+	.hook_mask	= (1 << NF_INET_EARLY_INGRESS) |
+			  (1 << NF_INET_INGRESS) |
 			  (1 << NF_INET_LOCAL_IN) |
 			  (1 << NF_INET_LOCAL_OUT) |
 			  (1 << NF_INET_FORWARD) |
 			  (1 << NF_INET_PRE_ROUTING) |
 			  (1 << NF_INET_POST_ROUTING),
 	.hooks		= {
+		[NF_INET_EARLY_INGRESS]	= nft_do_chain_inet_early_ingress,
 		[NF_INET_INGRESS]	= nft_do_chain_inet_ingress,
 		[NF_INET_LOCAL_IN]	= nft_do_chain_inet,
 		[NF_INET_LOCAL_OUT]	= nft_do_chain_inet,
@@ -324,15 +382,69 @@ static unsigned int nft_do_chain_netdev(void *priv, struct sk_buff *skb,
 	return nft_do_chain(&pkt, priv);
 }
 
+static unsigned int
+nft_do_chain_netdev_early_ingress(void *priv, struct sk_buff *unused,
+				  const struct nf_hook_state *state)
+{
+	struct nf_hook_state ingress_state = *state;
+	struct sk_buff *skb, *nskb;
+	struct nft_pktinfo pkt;
+	LIST_HEAD(accept_list);
+	int ret;
+
+	list_for_each_entry_safe(skb, nskb, state->skb_list, list) {
+		skb_list_del_init(skb);
+
+		skb_reset_network_header(skb);
+		if (!skb_transport_header_was_set(skb))
+			skb_reset_transport_header(skb);
+		skb_reset_mac_len(skb);
+
+		ret = nft_set_pktinfo_ingress(&pkt, skb, &ingress_state);
+		switch (ret) {
+		case 1:
+		case -1:
+			nft_set_pktinfo(&pkt, skb, &ingress_state);
+			break;
+		default:
+			break;
+		}
+
+		ret = nft_do_chain(&pkt, priv);
+		switch (ret) {
+		case NF_ACCEPT:
+			list_add_tail(&skb->list, &accept_list);
+			break;
+		default:
+			WARN_ON_ONCE(1);
+			fallthrough;
+		case NF_DROP:
+			kfree_skb(skb);
+			break;
+		}
+	}
+
+	WARN_ON_ONCE(!list_empty(state->skb_list));
+
+	list_splice(&accept_list, state->skb_list);
+
+	if (list_empty(state->skb_list))
+		return NF_STOLEN;
+
+	return NF_ACCEPT;
+}
+
 static const struct nft_chain_type nft_chain_filter_netdev = {
 	.name		= "filter",
 	.type		= NFT_CHAIN_T_DEFAULT,
 	.family		= NFPROTO_NETDEV,
 	.hook_mask	= (1 << NF_NETDEV_INGRESS) |
-			  (1 << NF_NETDEV_EGRESS),
+			  (1 << NF_NETDEV_EGRESS) |
+			  (1 << NF_NETDEV_EARLY_INGRESS),
 	.hooks		= {
 		[NF_NETDEV_INGRESS]	= nft_do_chain_netdev,
 		[NF_NETDEV_EGRESS]	= nft_do_chain_netdev,
+		[NF_NETDEV_EARLY_INGRESS] = nft_do_chain_netdev_early_ingress,
 	},
 };
 
-- 
2.47.3