restore: networking stack files from reflog (Phases 1-6)

Recovered from reflog commits 1c80937e and d0ecc067 after force-push data loss.
Includes: filter/, icmp_error.rs, slaac.rs, bond.rs, bridge.rs, gre.rs, ipip.rs,
qdisc.rs, tun.rs, vlan.rs, vxlan.rs, netfilter.rs, tun.rs, conntrack.rs, nat.rs,
rule.rs, table.rs, redbear-ufw/, dhcpv6d/, netdiag/ — 39 files total.

netstack/src/scheme/mod.rs

@@ -33,19 +33,25 @@ use syscall::Error as SyscallError;
 use self::icmp::IcmpScheme;
 use self::ip::IpScheme;
 use self::netcfg::NetCfgScheme;
+use self::netfilter::NetFilterScheme;
 use self::tcp::TcpScheme;
+use self::tun::TunScheme;
 use self::udp::UdpScheme;
 use crate::error::{Error, Result};
+use crate::filter::{FilterTable, PacketContext, Verdict};
 
 mod icmp;
 mod ip;
 mod netcfg;
+mod netfilter;
 mod socket;
 mod tcp;
+mod tun;
 mod udp;
 
 type SocketSet = SmoltcpSocketSet<'static>;
 type Interface = Rc<RefCell<SmoltcpInterface>>;
+type FilterTableRef = Rc<RefCell<FilterTable>>;
 
 const MAX_DURATION: Duration = Duration::from_micros(u64::MAX);
 const MIN_DURATION: Duration = Duration::from_micros(0);
@@ -70,6 +76,8 @@ pub struct Smolnetd {
     tcp_scheme: TcpScheme,
     icmp_scheme: IcmpScheme,
     netcfg_scheme: NetCfgScheme,
+    netfilter_scheme: NetFilterScheme,
+    filter_table: FilterTableRef,
 }
 
 impl Smolnetd {
@@ -87,11 +95,13 @@ impl Smolnetd {
         icmp_file: Socket,
         time_file: Fd,
         netcfg_file: Socket,
+        netfilter_file: Socket,
     ) -> Result<Smolnetd> {
         let protocol_addrs = vec![
             //This is a placeholder IP for DHCP
             IpCidr::new(IpAddress::v4(0, 0, 0, 0), 8),
             IpCidr::new(IpAddress::v4(127, 0, 0, 1), 8),
+            IpCidr::new(IpAddress::v6(0, 0, 0, 0, 0, 0, 0, 1), 128),
         ];
 
         let default_gw = Ipv4Address::from_str(getcfg("ip_router").unwrap().trim())
@@ -114,6 +124,7 @@ impl Smolnetd {
 
         let iface = Rc::new(RefCell::new(iface));
         let socket_set = Rc::new(RefCell::new(SocketSet::new(vec![])));
+        let filter_table = Rc::new(RefCell::new(FilterTable::new()));
 
         let loopback = LoopbackDevice::default();
         route_table.borrow_mut().insert_rule(Rule::new(
@@ -122,6 +133,12 @@ impl Smolnetd {
             Rc::clone(loopback.name()),
             "127.0.0.1".parse().unwrap(),
         ));
+        route_table.borrow_mut().insert_rule(Rule::new(
+            "::1/128".parse().unwrap(),
+            None,
+            Rc::clone(loopback.name()),
+            "::1".parse().unwrap(),
+        ));
 
         let mut eth0 = EthernetLink::new("eth0", unsafe {
             File::from_raw_fd(network_file.into_raw() as RawFd)
@@ -172,6 +189,11 @@ impl Smolnetd {
                 Rc::clone(&devices),
                 Rc::clone(&socket_set),
             )?,
+            netfilter_scheme: NetFilterScheme::new(
+                netfilter_file,
+                Rc::clone(&filter_table),
+            )?,
+            filter_table,
         })
     }
 
@@ -216,6 +238,11 @@ impl Smolnetd {
         Ok(())
     }
 
+    pub fn on_netfilter_scheme_event(&mut self) -> Result<()> {
+        self.netfilter_scheme.on_scheme_event()?;
+        Ok(())
+    }
+
     fn schedule_time_event(&mut self, timeout: Duration) -> Result<()> {
         let mut time = TimeSpec::default();
         if self.time_file.read(&mut time)? < size_of::<TimeSpec>() {
@@ -249,10 +276,22 @@ impl Smolnetd {
 
                 self.router_device.get_mut().poll(timestamp);
 
+                self.router_device.get_mut().forward_packets(&self.filter_table, timestamp);
+
+                // INPUT filter hook: drop packets before smoltcp processing.
+                // Mirrors Linux's NF_INET_LOCAL_IN hook in iptable_filter.c.
+                self.router_device.get_mut().filter_input(&self.filter_table, timestamp);
+
                 // TODO: Check what if the bool returned by poll can be useful
                 iface.poll(timestamp, &mut self.router_device, &mut socket_set);
 
-                self.router_device.get_mut().dispatch(timestamp);
+                self.router_device.get_mut().dispatch(timestamp, &self.filter_table);
+
+                self.filter_table
+                    .borrow_mut()
+                    .conntrack
+                    .as_mut()
+                    .map(|ct| ct.clean_expired(timestamp));
 
                 if !self.router_device.get_ref().can_recv() {
                     match iface.poll_delay(timestamp, &socket_set) {