2 * Description: EBTables 802.1Q match extension kernelspace module.
3 * Authors: Nick Fedchik <nick@fedchik.org.ua>
4 * Bart De Schuymer <bdschuym@pandora.be>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 #include <linux/if_ether.h>
22 #include <linux/if_vlan.h>
23 #include <linux/module.h>
24 #include <linux/moduleparam.h>
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter_bridge/ebtables.h>
27 #include <linux/netfilter_bridge/ebt_vlan.h>
30 #define MODULE_VERS "0.6"
32 module_param(debug
, int, 0);
33 MODULE_PARM_DESC(debug
, "debug=1 is turn on debug messages");
34 MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
35 MODULE_DESCRIPTION("Ebtables: 802.1Q VLAN tag match");
36 MODULE_LICENSE("GPL");
39 #define DEBUG_MSG(args...) if (debug) printk (KERN_DEBUG "ebt_vlan: " args)
40 #define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
41 #define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; }
44 ebt_vlan_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
46 const struct ebt_vlan_info
*info
= par
->matchinfo
;
47 const struct vlan_hdr
*fp
;
48 struct vlan_hdr _frame
;
50 unsigned short TCI
; /* Whole TCI, given from parsed frame */
51 unsigned short id
; /* VLAN ID, given from frame TCI */
52 unsigned char prio
; /* user_priority, given from frame TCI */
53 /* VLAN encapsulated Type/Length field, given from orig frame */
56 fp
= skb_header_pointer(skb
, 0, sizeof(_frame
), &_frame
);
60 /* Tag Control Information (TCI) consists of the following elements:
61 * - User_priority. The user_priority field is three bits in length,
62 * interpreted as a binary number.
63 * - Canonical Format Indicator (CFI). The Canonical Format Indicator
64 * (CFI) is a single bit flag value. Currently ignored.
65 * - VLAN Identifier (VID). The VID is encoded as
66 * an unsigned binary number. */
67 TCI
= ntohs(fp
->h_vlan_TCI
);
68 id
= TCI
& VLAN_VID_MASK
;
69 prio
= (TCI
>> 13) & 0x7;
70 encap
= fp
->h_vlan_encapsulated_proto
;
72 /* Checking VLAN Identifier (VID) */
73 if (GET_BITMASK(EBT_VLAN_ID
))
74 EXIT_ON_MISMATCH(id
, EBT_VLAN_ID
);
76 /* Checking user_priority */
77 if (GET_BITMASK(EBT_VLAN_PRIO
))
78 EXIT_ON_MISMATCH(prio
, EBT_VLAN_PRIO
);
80 /* Checking Encapsulated Proto (Length/Type) field */
81 if (GET_BITMASK(EBT_VLAN_ENCAP
))
82 EXIT_ON_MISMATCH(encap
, EBT_VLAN_ENCAP
);
88 ebt_vlan_mt_check(const char *table
, const void *entry
,
89 const struct xt_match
*match
, void *data
,
90 unsigned int hook_mask
)
92 struct ebt_vlan_info
*info
= data
;
93 const struct ebt_entry
*e
= entry
;
95 /* Is it 802.1Q frame checked? */
96 if (e
->ethproto
!= htons(ETH_P_8021Q
)) {
98 ("passed entry proto %2.4X is not 802.1Q (8100)\n",
99 (unsigned short) ntohs(e
->ethproto
));
103 /* Check for bitmask range
104 * True if even one bit is out of mask */
105 if (info
->bitmask
& ~EBT_VLAN_MASK
) {
106 DEBUG_MSG("bitmask %2X is out of mask (%2X)\n",
107 info
->bitmask
, EBT_VLAN_MASK
);
111 /* Check for inversion flags range */
112 if (info
->invflags
& ~EBT_VLAN_MASK
) {
113 DEBUG_MSG("inversion flags %2X is out of mask (%2X)\n",
114 info
->invflags
, EBT_VLAN_MASK
);
118 /* Reserved VLAN ID (VID) values
119 * -----------------------------
120 * 0 - The null VLAN ID.
121 * 1 - The default Port VID (PVID)
122 * 0x0FFF - Reserved for implementation use.
123 * if_vlan.h: VLAN_GROUP_ARRAY_LEN 4096. */
124 if (GET_BITMASK(EBT_VLAN_ID
)) {
125 if (!!info
->id
) { /* if id!=0 => check vid range */
126 if (info
->id
> VLAN_GROUP_ARRAY_LEN
) {
128 ("id %d is out of range (1-4096)\n",
132 /* Note: This is valid VLAN-tagged frame point.
133 * Any value of user_priority are acceptable,
134 * but should be ignored according to 802.1Q Std.
135 * So we just drop the prio flag. */
136 info
->bitmask
&= ~EBT_VLAN_PRIO
;
138 /* Else, id=0 (null VLAN ID) => user_priority range (any?) */
141 if (GET_BITMASK(EBT_VLAN_PRIO
)) {
142 if ((unsigned char) info
->prio
> 7) {
143 DEBUG_MSG("prio %d is out of range (0-7)\n",
148 /* Check for encapsulated proto range - it is possible to be
149 * any value for u_short range.
150 * if_ether.h: ETH_ZLEN 60 - Min. octets in frame sans FCS */
151 if (GET_BITMASK(EBT_VLAN_ENCAP
)) {
152 if ((unsigned short) ntohs(info
->encap
) < ETH_ZLEN
) {
154 ("encap frame length %d is less than minimal\n",
163 static struct xt_match ebt_vlan_mt_reg __read_mostly
= {
166 .family
= NFPROTO_BRIDGE
,
167 .match
= ebt_vlan_mt
,
168 .checkentry
= ebt_vlan_mt_check
,
169 .matchsize
= XT_ALIGN(sizeof(struct ebt_vlan_info
)),
173 static int __init
ebt_vlan_init(void)
175 DEBUG_MSG("ebtables 802.1Q extension module v"
177 DEBUG_MSG("module debug=%d\n", !!debug
);
178 return xt_register_match(&ebt_vlan_mt_reg
);
181 static void __exit
ebt_vlan_fini(void)
183 xt_unregister_match(&ebt_vlan_mt_reg
);
186 module_init(ebt_vlan_init
);
187 module_exit(ebt_vlan_fini
);