1 /* 2 * ebt_stp 3 * 4 * Authors: 5 * Bart De Schuymer <bdschuym@pandora.be> 6 * Stephen Hemminger <shemminger@osdl.org> 7 * 8 * July, 2003 9 */ 10 #include <linux/etherdevice.h> 11 #include <linux/module.h> 12 #include <linux/netfilter/x_tables.h> 13 #include <linux/netfilter_bridge/ebtables.h> 14 #include <linux/netfilter_bridge/ebt_stp.h> 15 16 #define BPDU_TYPE_CONFIG 0 17 #define BPDU_TYPE_TCN 0x80 18 19 struct stp_header { 20 u8 dsap; 21 u8 ssap; 22 u8 ctrl; 23 u8 pid; 24 u8 vers; 25 u8 type; 26 }; 27 28 struct stp_config_pdu { 29 u8 flags; 30 u8 root[8]; 31 u8 root_cost[4]; 32 u8 sender[8]; 33 u8 port[2]; 34 u8 msg_age[2]; 35 u8 max_age[2]; 36 u8 hello_time[2]; 37 u8 forward_delay[2]; 38 }; 39 40 #define NR16(p) (p[0] << 8 | p[1]) 41 #define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3]) 42 43 static bool ebt_filter_config(const struct ebt_stp_info *info, 44 const struct stp_config_pdu *stpc) 45 { 46 const struct ebt_stp_config_info *c; 47 u16 v16; 48 u32 v32; 49 50 c = &info->config; 51 if ((info->bitmask & EBT_STP_FLAGS) && 52 NF_INVF(info, EBT_STP_FLAGS, c->flags != stpc->flags)) 53 return false; 54 if (info->bitmask & EBT_STP_ROOTPRIO) { 55 v16 = NR16(stpc->root); 56 if (NF_INVF(info, EBT_STP_ROOTPRIO, 57 v16 < c->root_priol || v16 > c->root_priou)) 58 return false; 59 } 60 if (info->bitmask & EBT_STP_ROOTADDR) { 61 if (NF_INVF(info, EBT_STP_ROOTADDR, 62 !ether_addr_equal_masked(&stpc->root[2], 63 c->root_addr, 64 c->root_addrmsk))) 65 return false; 66 } 67 if (info->bitmask & EBT_STP_ROOTCOST) { 68 v32 = NR32(stpc->root_cost); 69 if (NF_INVF(info, EBT_STP_ROOTCOST, 70 v32 < c->root_costl || v32 > c->root_costu)) 71 return false; 72 } 73 if (info->bitmask & EBT_STP_SENDERPRIO) { 74 v16 = NR16(stpc->sender); 75 if (NF_INVF(info, EBT_STP_SENDERPRIO, 76 v16 < c->sender_priol || v16 > c->sender_priou)) 77 return false; 78 } 79 if (info->bitmask & EBT_STP_SENDERADDR) { 80 if (NF_INVF(info, EBT_STP_SENDERADDR, 81 !ether_addr_equal_masked(&stpc->sender[2], 82 c->sender_addr, 83 c->sender_addrmsk))) 84 return false; 85 } 86 if (info->bitmask & EBT_STP_PORT) { 87 v16 = NR16(stpc->port); 88 if (NF_INVF(info, EBT_STP_PORT, 89 v16 < c->portl || v16 > c->portu)) 90 return false; 91 } 92 if (info->bitmask & EBT_STP_MSGAGE) { 93 v16 = NR16(stpc->msg_age); 94 if (NF_INVF(info, EBT_STP_MSGAGE, 95 v16 < c->msg_agel || v16 > c->msg_ageu)) 96 return false; 97 } 98 if (info->bitmask & EBT_STP_MAXAGE) { 99 v16 = NR16(stpc->max_age); 100 if (NF_INVF(info, EBT_STP_MAXAGE, 101 v16 < c->max_agel || v16 > c->max_ageu)) 102 return false; 103 } 104 if (info->bitmask & EBT_STP_HELLOTIME) { 105 v16 = NR16(stpc->hello_time); 106 if (NF_INVF(info, EBT_STP_HELLOTIME, 107 v16 < c->hello_timel || v16 > c->hello_timeu)) 108 return false; 109 } 110 if (info->bitmask & EBT_STP_FWDD) { 111 v16 = NR16(stpc->forward_delay); 112 if (NF_INVF(info, EBT_STP_FWDD, 113 v16 < c->forward_delayl || v16 > c->forward_delayu)) 114 return false; 115 } 116 return true; 117 } 118 119 static bool 120 ebt_stp_mt(const struct sk_buff *skb, struct xt_action_param *par) 121 { 122 const struct ebt_stp_info *info = par->matchinfo; 123 const struct stp_header *sp; 124 struct stp_header _stph; 125 const u8 header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00}; 126 127 sp = skb_header_pointer(skb, 0, sizeof(_stph), &_stph); 128 if (sp == NULL) 129 return false; 130 131 /* The stp code only considers these */ 132 if (memcmp(sp, header, sizeof(header))) 133 return false; 134 135 if ((info->bitmask & EBT_STP_TYPE) && 136 NF_INVF(info, EBT_STP_TYPE, info->type != sp->type)) 137 return false; 138 139 if (sp->type == BPDU_TYPE_CONFIG && 140 info->bitmask & EBT_STP_CONFIG_MASK) { 141 const struct stp_config_pdu *st; 142 struct stp_config_pdu _stpc; 143 144 st = skb_header_pointer(skb, sizeof(_stph), 145 sizeof(_stpc), &_stpc); 146 if (st == NULL) 147 return false; 148 return ebt_filter_config(info, st); 149 } 150 return true; 151 } 152 153 static int ebt_stp_mt_check(const struct xt_mtchk_param *par) 154 { 155 const struct ebt_stp_info *info = par->matchinfo; 156 const u8 bridge_ula[6] = {0x01, 0x80, 0xc2, 0x00, 0x00, 0x00}; 157 const u8 msk[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; 158 const struct ebt_entry *e = par->entryinfo; 159 160 if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK || 161 !(info->bitmask & EBT_STP_MASK)) 162 return -EINVAL; 163 /* Make sure the match only receives stp frames */ 164 if (!par->nft_compat && 165 (!ether_addr_equal(e->destmac, bridge_ula) || 166 !ether_addr_equal(e->destmsk, msk) || 167 !(e->bitmask & EBT_DESTMAC))) 168 return -EINVAL; 169 170 return 0; 171 } 172 173 static struct xt_match ebt_stp_mt_reg __read_mostly = { 174 .name = "stp", 175 .revision = 0, 176 .family = NFPROTO_BRIDGE, 177 .match = ebt_stp_mt, 178 .checkentry = ebt_stp_mt_check, 179 .matchsize = sizeof(struct ebt_stp_info), 180 .me = THIS_MODULE, 181 }; 182 183 static int __init ebt_stp_init(void) 184 { 185 return xt_register_match(&ebt_stp_mt_reg); 186 } 187 188 static void __exit ebt_stp_fini(void) 189 { 190 xt_unregister_match(&ebt_stp_mt_reg); 191 } 192 193 module_init(ebt_stp_init); 194 module_exit(ebt_stp_fini); 195 MODULE_DESCRIPTION("Ebtables: Spanning Tree Protocol packet match"); 196 MODULE_LICENSE("GPL"); 197