2 * Description: EBTables 802.1Q match extension kernelspace module.
3 * Authors: Nick Fedchik <nick@fedchik.org.ua>
4 * Bart De Schuymer <bdschuym@pandora.be>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 #include <linux/if_ether.h>
22 #include <linux/if_vlan.h>
23 #include <linux/module.h>
24 #include <linux/moduleparam.h>
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter_bridge/ebtables.h>
27 #include <linux/netfilter_bridge/ebt_vlan.h>
29 #define MODULE_VERS "0.6"
31 MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
32 MODULE_DESCRIPTION("Ebtables: 802.1Q VLAN tag match");
33 MODULE_LICENSE("GPL");
35 #define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
36 #define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; }
39 ebt_vlan_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
41 const struct ebt_vlan_info
*info
= par
->matchinfo
;
42 const struct vlan_hdr
*fp
;
43 struct vlan_hdr _frame
;
45 unsigned short TCI
; /* Whole TCI, given from parsed frame */
46 unsigned short id
; /* VLAN ID, given from frame TCI */
47 unsigned char prio
; /* user_priority, given from frame TCI */
48 /* VLAN encapsulated Type/Length field, given from orig frame */
51 fp
= skb_header_pointer(skb
, 0, sizeof(_frame
), &_frame
);
55 /* Tag Control Information (TCI) consists of the following elements:
56 * - User_priority. The user_priority field is three bits in length,
57 * interpreted as a binary number.
58 * - Canonical Format Indicator (CFI). The Canonical Format Indicator
59 * (CFI) is a single bit flag value. Currently ignored.
60 * - VLAN Identifier (VID). The VID is encoded as
61 * an unsigned binary number. */
62 TCI
= ntohs(fp
->h_vlan_TCI
);
63 id
= TCI
& VLAN_VID_MASK
;
64 prio
= (TCI
>> 13) & 0x7;
65 encap
= fp
->h_vlan_encapsulated_proto
;
67 /* Checking VLAN Identifier (VID) */
68 if (GET_BITMASK(EBT_VLAN_ID
))
69 EXIT_ON_MISMATCH(id
, EBT_VLAN_ID
);
71 /* Checking user_priority */
72 if (GET_BITMASK(EBT_VLAN_PRIO
))
73 EXIT_ON_MISMATCH(prio
, EBT_VLAN_PRIO
);
75 /* Checking Encapsulated Proto (Length/Type) field */
76 if (GET_BITMASK(EBT_VLAN_ENCAP
))
77 EXIT_ON_MISMATCH(encap
, EBT_VLAN_ENCAP
);
82 static int ebt_vlan_mt_check(const struct xt_mtchk_param
*par
)
84 struct ebt_vlan_info
*info
= par
->matchinfo
;
85 const struct ebt_entry
*e
= par
->entryinfo
;
87 /* Is it 802.1Q frame checked? */
88 if (e
->ethproto
!= htons(ETH_P_8021Q
)) {
89 pr_debug("passed entry proto %2.4X is not 802.1Q (8100)\n",
94 /* Check for bitmask range
95 * True if even one bit is out of mask */
96 if (info
->bitmask
& ~EBT_VLAN_MASK
) {
97 pr_debug("bitmask %2X is out of mask (%2X)\n",
98 info
->bitmask
, EBT_VLAN_MASK
);
102 /* Check for inversion flags range */
103 if (info
->invflags
& ~EBT_VLAN_MASK
) {
104 pr_debug("inversion flags %2X is out of mask (%2X)\n",
105 info
->invflags
, EBT_VLAN_MASK
);
109 /* Reserved VLAN ID (VID) values
110 * -----------------------------
111 * 0 - The null VLAN ID.
112 * 1 - The default Port VID (PVID)
113 * 0x0FFF - Reserved for implementation use.
114 * if_vlan.h: VLAN_GROUP_ARRAY_LEN 4096. */
115 if (GET_BITMASK(EBT_VLAN_ID
)) {
116 if (!!info
->id
) { /* if id!=0 => check vid range */
117 if (info
->id
> VLAN_GROUP_ARRAY_LEN
) {
118 pr_debug("id %d is out of range (1-4096)\n",
122 /* Note: This is valid VLAN-tagged frame point.
123 * Any value of user_priority are acceptable,
124 * but should be ignored according to 802.1Q Std.
125 * So we just drop the prio flag. */
126 info
->bitmask
&= ~EBT_VLAN_PRIO
;
128 /* Else, id=0 (null VLAN ID) => user_priority range (any?) */
131 if (GET_BITMASK(EBT_VLAN_PRIO
)) {
132 if ((unsigned char) info
->prio
> 7) {
133 pr_debug("prio %d is out of range (0-7)\n",
138 /* Check for encapsulated proto range - it is possible to be
139 * any value for u_short range.
140 * if_ether.h: ETH_ZLEN 60 - Min. octets in frame sans FCS */
141 if (GET_BITMASK(EBT_VLAN_ENCAP
)) {
142 if ((unsigned short) ntohs(info
->encap
) < ETH_ZLEN
) {
143 pr_debug("encap frame length %d is less than "
144 "minimal\n", ntohs(info
->encap
));
152 static struct xt_match ebt_vlan_mt_reg __read_mostly
= {
155 .family
= NFPROTO_BRIDGE
,
156 .match
= ebt_vlan_mt
,
157 .checkentry
= ebt_vlan_mt_check
,
158 .matchsize
= sizeof(struct ebt_vlan_info
),
162 static int __init
ebt_vlan_init(void)
164 pr_debug("ebtables 802.1Q extension module v" MODULE_VERS
"\n");
165 return xt_register_match(&ebt_vlan_mt_reg
);
168 static void __exit
ebt_vlan_fini(void)
170 xt_unregister_match(&ebt_vlan_mt_reg
);
173 module_init(ebt_vlan_init
);
174 module_exit(ebt_vlan_fini
);