1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include <linux/if_ether.h>
22#include <linux/if_vlan.h>
23#include <linux/module.h>
24#include <linux/moduleparam.h>
25#include <linux/netfilter/x_tables.h>
26#include <linux/netfilter_bridge/ebtables.h>
27#include <linux/netfilter_bridge/ebt_vlan.h>
28
29static int debug;
30#define MODULE_VERS "0.6"
31
32module_param(debug, int, 0);
33MODULE_PARM_DESC(debug, "debug=1 is turn on debug messages");
34MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
35MODULE_DESCRIPTION("Ebtables: 802.1Q VLAN tag match");
36MODULE_LICENSE("GPL");
37
38
39#define DEBUG_MSG(args...) if (debug) printk (KERN_DEBUG "ebt_vlan: " args)
40#define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
41#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; }
42
43static bool
44ebt_vlan_mt(const struct sk_buff *skb, const struct xt_match_param *par)
45{
46 const struct ebt_vlan_info *info = par->matchinfo;
47 const struct vlan_hdr *fp;
48 struct vlan_hdr _frame;
49
50 unsigned short TCI;
51 unsigned short id;
52 unsigned char prio;
53
54 __be16 encap;
55
56 fp = skb_header_pointer(skb, 0, sizeof(_frame), &_frame);
57 if (fp == NULL)
58 return false;
59
60
61
62
63
64
65
66
67 TCI = ntohs(fp->h_vlan_TCI);
68 id = TCI & VLAN_VID_MASK;
69 prio = (TCI >> 13) & 0x7;
70 encap = fp->h_vlan_encapsulated_proto;
71
72
73 if (GET_BITMASK(EBT_VLAN_ID))
74 EXIT_ON_MISMATCH(id, EBT_VLAN_ID);
75
76
77 if (GET_BITMASK(EBT_VLAN_PRIO))
78 EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO);
79
80
81 if (GET_BITMASK(EBT_VLAN_ENCAP))
82 EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP);
83
84 return true;
85}
86
87static bool ebt_vlan_mt_check(const struct xt_mtchk_param *par)
88{
89 struct ebt_vlan_info *info = par->matchinfo;
90 const struct ebt_entry *e = par->entryinfo;
91
92
93 if (e->ethproto != htons(ETH_P_8021Q)) {
94 DEBUG_MSG
95 ("passed entry proto %2.4X is not 802.1Q (8100)\n",
96 (unsigned short) ntohs(e->ethproto));
97 return false;
98 }
99
100
101
102 if (info->bitmask & ~EBT_VLAN_MASK) {
103 DEBUG_MSG("bitmask %2X is out of mask (%2X)\n",
104 info->bitmask, EBT_VLAN_MASK);
105 return false;
106 }
107
108
109 if (info->invflags & ~EBT_VLAN_MASK) {
110 DEBUG_MSG("inversion flags %2X is out of mask (%2X)\n",
111 info->invflags, EBT_VLAN_MASK);
112 return false;
113 }
114
115
116
117
118
119
120
121 if (GET_BITMASK(EBT_VLAN_ID)) {
122 if (!!info->id) {
123 if (info->id > VLAN_GROUP_ARRAY_LEN) {
124 DEBUG_MSG
125 ("id %d is out of range (1-4096)\n",
126 info->id);
127 return false;
128 }
129
130
131
132
133 info->bitmask &= ~EBT_VLAN_PRIO;
134 }
135
136 }
137
138 if (GET_BITMASK(EBT_VLAN_PRIO)) {
139 if ((unsigned char) info->prio > 7) {
140 DEBUG_MSG("prio %d is out of range (0-7)\n",
141 info->prio);
142 return false;
143 }
144 }
145
146
147
148 if (GET_BITMASK(EBT_VLAN_ENCAP)) {
149 if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) {
150 DEBUG_MSG
151 ("encap frame length %d is less than minimal\n",
152 ntohs(info->encap));
153 return false;
154 }
155 }
156
157 return true;
158}
159
160static struct xt_match ebt_vlan_mt_reg __read_mostly = {
161 .name = "vlan",
162 .revision = 0,
163 .family = NFPROTO_BRIDGE,
164 .match = ebt_vlan_mt,
165 .checkentry = ebt_vlan_mt_check,
166 .matchsize = XT_ALIGN(sizeof(struct ebt_vlan_info)),
167 .me = THIS_MODULE,
168};
169
170static int __init ebt_vlan_init(void)
171{
172 DEBUG_MSG("ebtables 802.1Q extension module v"
173 MODULE_VERS "\n");
174 DEBUG_MSG("module debug=%d\n", !!debug);
175 return xt_register_match(&ebt_vlan_mt_reg);
176}
177
178static void __exit ebt_vlan_fini(void)
179{
180 xt_unregister_match(&ebt_vlan_mt_reg);
181}
182
183module_init(ebt_vlan_init);
184module_exit(ebt_vlan_fini);
185