1/* 2 * Description: EBTables 802.1Q match extension kernelspace module. 3 * Authors: Nick Fedchik <nick@fedchik.org.ua> 4 * Bart De Schuymer <bdschuym@pandora.be> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19 */ 20 21#include <linux/if_ether.h> 22#include <linux/if_vlan.h> 23#include <linux/module.h> 24#include <linux/moduleparam.h> 25#include <linux/netfilter/x_tables.h> 26#include <linux/netfilter_bridge/ebtables.h> 27#include <linux/netfilter_bridge/ebt_vlan.h> 28 29#define MODULE_VERS "0.6" 30 31MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>"); 32MODULE_DESCRIPTION("Ebtables: 802.1Q VLAN tag match"); 33MODULE_LICENSE("GPL"); 34 35#define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_ 36#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; } 37 38static bool 39ebt_vlan_mt(const struct sk_buff *skb, struct xt_action_param *par) 40{ 41 const struct ebt_vlan_info *info = par->matchinfo; 42 const struct vlan_hdr *fp; 43 struct vlan_hdr _frame; 44 45 unsigned short TCI; /* Whole TCI, given from parsed frame */ 46 unsigned short id; /* VLAN ID, given from frame TCI */ 47 unsigned char prio; /* user_priority, given from frame TCI */ 48 /* VLAN encapsulated Type/Length field, given from orig frame */ 49 __be16 encap; 50 51 fp = skb_header_pointer(skb, 0, sizeof(_frame), &_frame); 52 if (fp == NULL) 53 return false; 54 55 /* Tag Control Information (TCI) consists of the following elements: 56 * - User_priority. The user_priority field is three bits in length, 57 * interpreted as a binary number. 58 * - Canonical Format Indicator (CFI). The Canonical Format Indicator 59 * (CFI) is a single bit flag value. Currently ignored. 60 * - VLAN Identifier (VID). The VID is encoded as 61 * an unsigned binary number. */ 62 TCI = ntohs(fp->h_vlan_TCI); 63 id = TCI & VLAN_VID_MASK; 64 prio = (TCI >> 13) & 0x7; 65 encap = fp->h_vlan_encapsulated_proto; 66 67 /* Checking VLAN Identifier (VID) */ 68 if (GET_BITMASK(EBT_VLAN_ID)) 69 EXIT_ON_MISMATCH(id, EBT_VLAN_ID); 70 71 /* Checking user_priority */ 72 if (GET_BITMASK(EBT_VLAN_PRIO)) 73 EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO); 74 75 /* Checking Encapsulated Proto (Length/Type) field */ 76 if (GET_BITMASK(EBT_VLAN_ENCAP)) 77 EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP); 78 79 return true; 80} 81 82static int ebt_vlan_mt_check(const struct xt_mtchk_param *par) 83{ 84 struct ebt_vlan_info *info = par->matchinfo; 85 const struct ebt_entry *e = par->entryinfo; 86 87 /* Is it 802.1Q frame checked? */ 88 if (e->ethproto != htons(ETH_P_8021Q)) { 89 pr_debug("passed entry proto %2.4X is not 802.1Q (8100)\n", 90 ntohs(e->ethproto)); 91 return -EINVAL; 92 } 93 94 /* Check for bitmask range 95 * True if even one bit is out of mask */ 96 if (info->bitmask & ~EBT_VLAN_MASK) { 97 pr_debug("bitmask %2X is out of mask (%2X)\n", 98 info->bitmask, EBT_VLAN_MASK); 99 return -EINVAL; 100 } 101 102 /* Check for inversion flags range */ 103 if (info->invflags & ~EBT_VLAN_MASK) { 104 pr_debug("inversion flags %2X is out of mask (%2X)\n", 105 info->invflags, EBT_VLAN_MASK); 106 return -EINVAL; 107 } 108 109 /* Reserved VLAN ID (VID) values 110 * ----------------------------- 111 * 0 - The null VLAN ID. 112 * 1 - The default Port VID (PVID) 113 * 0x0FFF - Reserved for implementation use. 114 * if_vlan.h: VLAN_GROUP_ARRAY_LEN 4096. */ 115 if (GET_BITMASK(EBT_VLAN_ID)) { 116 if (!!info->id) { /* if id!=0 => check vid range */ 117 if (info->id > VLAN_GROUP_ARRAY_LEN) { 118 pr_debug("id %d is out of range (1-4096)\n", 119 info->id); 120 return -EINVAL; 121 } 122 /* Note: This is valid VLAN-tagged frame point. 123 * Any value of user_priority are acceptable, 124 * but should be ignored according to 802.1Q Std. 125 * So we just drop the prio flag. */ 126 info->bitmask &= ~EBT_VLAN_PRIO; 127 } 128 /* Else, id=0 (null VLAN ID) => user_priority range (any?) */ 129 } 130 131 if (GET_BITMASK(EBT_VLAN_PRIO)) { 132 if ((unsigned char) info->prio > 7) { 133 pr_debug("prio %d is out of range (0-7)\n", 134 info->prio); 135 return -EINVAL; 136 } 137 } 138 /* Check for encapsulated proto range - it is possible to be 139 * any value for u_short range. 140 * if_ether.h: ETH_ZLEN 60 - Min. octets in frame sans FCS */ 141 if (GET_BITMASK(EBT_VLAN_ENCAP)) { 142 if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) { 143 pr_debug("encap frame length %d is less than " 144 "minimal\n", ntohs(info->encap)); 145 return -EINVAL; 146 } 147 } 148 149 return 0; 150} 151 152static struct xt_match ebt_vlan_mt_reg __read_mostly = { 153 .name = "vlan", 154 .revision = 0, 155 .family = NFPROTO_BRIDGE, 156 .match = ebt_vlan_mt, 157 .checkentry = ebt_vlan_mt_check, 158 .matchsize = sizeof(struct ebt_vlan_info), 159 .me = THIS_MODULE, 160}; 161 162static int __init ebt_vlan_init(void) 163{ 164 pr_debug("ebtables 802.1Q extension module v" MODULE_VERS "\n"); 165 return xt_register_match(&ebt_vlan_mt_reg); 166} 167 168static void __exit ebt_vlan_fini(void) 169{ 170 xt_unregister_match(&ebt_vlan_mt_reg); 171} 172 173module_init(ebt_vlan_init); 174module_exit(ebt_vlan_fini); 175