[05/12] netfilter: hook packets before receive

diff --git a/include/net/filter.h b/include/net/filter.h
index 1dd86cf..5292563 100644
--- a/include/net/filter.h
+++ b/include/net/filter.h
@@ -12,11 +12,27 @@ 
 #include "qemu/typedefs.h"
 
 typedef void (FilterCleanup) (NetFilterState *);
+/*
+ * Return:
+ *   0: finished handling the packet, we should continue
+ *   size: filter stolen this packet, we stop pass this packet further
+ */
+typedef ssize_t (FilterReceive)(NetFilterState *, NetClientState *sender,
+                                unsigned flags, const uint8_t *, size_t);
+/*
+ * Return:
+ *   0: finished handling the packet, we should continue
+ *   size: filter stolen this packet, we stop pass this packet further
+ */
+typedef ssize_t (FilterReceiveIOV)(NetFilterState *, NetClientState *sender,
+                                   unsigned flags, const struct iovec *, int);
 
 typedef struct NetFilterInfo {
     NetFilterOptionsKind type;
     size_t size;
     FilterCleanup *cleanup;
+    FilterReceive *receive;
+    FilterReceiveIOV *receive_iov;
 } NetFilterInfo;
 
 struct NetFilterState {
diff --git a/net/net.c b/net/net.c
index 22748e0..e4c822c 100644
--- a/net/net.c
+++ b/net/net.c
@@ -24,6 +24,7 @@ 
 #include "config-host.h"
 
 #include "net/net.h"
+#include "net/filter.h"
 #include "clients.h"
 #include "hub.h"
 #include "net/slirp.h"
@@ -592,6 +593,25 @@  int qemu_can_send_packet(NetClientState *sender)
     return 1;
 }
 
+static ssize_t filter_receive(NetClientState *nc, NetClientState *sender,
+                              unsigned flags,
+                              const uint8_t *data,
+                              size_t size) {
+    ssize_t ret = 0;
+    Filter *filter = NULL;
+    NetFilterState *nf = NULL;
+
+    QTAILQ_FOREACH(filter, &nc->filters, next) {
+        nf = filter->nf;
+        ret = nf->info->receive(nf, sender, flags, data, size);
+        if (ret == size) {
+            return ret;
+        }
+    }
+
+    return ret;
+}
+
 ssize_t qemu_deliver_packet(NetClientState *sender,
                             unsigned flags,
                             const uint8_t *data,
@@ -609,6 +629,17 @@  ssize_t qemu_deliver_packet(NetClientState *sender,
         return 0;
     }
 
+    /* Let filters handle the packet first */
+    ret = filter_receive(sender, sender, flags, data, size);
+    if (ret == size) {
+        return size;
+    }
+
+    ret = filter_receive(nc, sender, flags, data, size);
+    if (ret == size) {
+        return size;
+    }
+
     if (flags & QEMU_NET_PACKET_FLAG_RAW && nc->info->receive_raw) {
         ret = nc->info->receive_raw(nc, data, size);
     } else {
@@ -697,6 +728,26 @@  ssize_t qemu_send_packet_raw(NetClientState *nc, const uint8_t *buf, int size)
                                              buf, size, NULL);
 }
 
+static ssize_t filter_receive_iov(NetClientState *nc, NetClientState *sender,
+                                  unsigned flags,
+                                  const struct iovec *iov,
+                                  int iovcnt) {
+    ssize_t ret = 0;
+    Filter *filter = NULL;
+    NetFilterState *nf = NULL;
+    ssize_t size = iov_size(iov, iovcnt);
+
+    QTAILQ_FOREACH(filter, &nc->filters, next) {
+        nf = filter->nf;
+        ret = nf->info->receive_iov(nf, sender, flags, iov, iovcnt);
+        if (ret == size) {
+            return ret;
+        }
+    }
+
+    return ret;
+}
+
 static ssize_t nc_sendv_compat(NetClientState *nc, const struct iovec *iov,
                                int iovcnt)
 {
@@ -716,15 +767,27 @@  ssize_t qemu_deliver_packet_iov(NetClientState *sender,
 {
     NetClientState *nc = opaque;
     int ret;
+    ssize_t size = iov_size(iov, iovcnt);
 
     if (nc->link_down) {
-        return iov_size(iov, iovcnt);
+        return size;
     }
 
     if (nc->receive_disabled) {
         return 0;
     }
 
+    /* Let filters handle the packet first */
+    ret = filter_receive_iov(sender, sender, flags, iov, iovcnt);
+    if (ret == size) {
+        return size;
+    }
+
+    ret = filter_receive_iov(nc, sender, flags, iov, iovcnt);
+    if (ret == size) {
+        return size;
+    }
+
     if (nc->info->receive_iov) {
         ret = nc->info->receive_iov(nc, iov, iovcnt);
     } else {