1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Description: EBTables 802.1Q match extension kernelspace module. 4 * Authors: Nick Fedchik <nick@fedchik.org.ua> 5 * Bart De Schuymer <bdschuym@pandora.be> 6 */ 7 8 #include <linux/if_ether.h> 9 #include <linux/if_vlan.h> 10 #include <linux/module.h> 11 #include <linux/moduleparam.h> 12 #include <linux/netfilter/x_tables.h> 13 #include <linux/netfilter_bridge/ebtables.h> 14 #include <linux/netfilter_bridge/ebt_vlan.h> 15 16 #define MODULE_VERS "0.6" 17 18 MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>"); 19 MODULE_DESCRIPTION("Ebtables: 802.1Q VLAN tag match"); 20 MODULE_LICENSE("GPL"); 21 22 #define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_ 23 #define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; } 24 25 static bool 26 ebt_vlan_mt(const struct sk_buff *skb, struct xt_action_param *par) 27 { 28 const struct ebt_vlan_info *info = par->matchinfo; 29 30 unsigned short TCI; /* Whole TCI, given from parsed frame */ 31 unsigned short id; /* VLAN ID, given from frame TCI */ 32 unsigned char prio; /* user_priority, given from frame TCI */ 33 /* VLAN encapsulated Type/Length field, given from orig frame */ 34 __be16 encap; 35 36 if (skb_vlan_tag_present(skb)) { 37 TCI = skb_vlan_tag_get(skb); 38 encap = skb->protocol; 39 } else { 40 const struct vlan_hdr *fp; 41 struct vlan_hdr _frame; 42 43 fp = skb_header_pointer(skb, 0, sizeof(_frame), &_frame); 44 if (fp == NULL) 45 return false; 46 47 TCI = ntohs(fp->h_vlan_TCI); 48 encap = fp->h_vlan_encapsulated_proto; 49 } 50 51 /* Tag Control Information (TCI) consists of the following elements: 52 * - User_priority. The user_priority field is three bits in length, 53 * interpreted as a binary number. 54 * - Canonical Format Indicator (CFI). The Canonical Format Indicator 55 * (CFI) is a single bit flag value. Currently ignored. 56 * - VLAN Identifier (VID). The VID is encoded as 57 * an unsigned binary number. 58 */ 59 id = TCI & VLAN_VID_MASK; 60 prio = (TCI >> 13) & 0x7; 61 62 /* Checking VLAN Identifier (VID) */ 63 if (GET_BITMASK(EBT_VLAN_ID)) 64 EXIT_ON_MISMATCH(id, EBT_VLAN_ID); 65 66 /* Checking user_priority */ 67 if (GET_BITMASK(EBT_VLAN_PRIO)) 68 EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO); 69 70 /* Checking Encapsulated Proto (Length/Type) field */ 71 if (GET_BITMASK(EBT_VLAN_ENCAP)) 72 EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP); 73 74 return true; 75 } 76 77 static int ebt_vlan_mt_check(const struct xt_mtchk_param *par) 78 { 79 struct ebt_vlan_info *info = par->matchinfo; 80 const struct ebt_entry *e = par->entryinfo; 81 82 /* Is it 802.1Q frame checked? */ 83 if (e->ethproto != htons(ETH_P_8021Q)) { 84 pr_debug("passed entry proto %2.4X is not 802.1Q (8100)\n", 85 ntohs(e->ethproto)); 86 return -EINVAL; 87 } 88 89 /* Check for bitmask range 90 * True if even one bit is out of mask 91 */ 92 if (info->bitmask & ~EBT_VLAN_MASK) { 93 pr_debug("bitmask %2X is out of mask (%2X)\n", 94 info->bitmask, EBT_VLAN_MASK); 95 return -EINVAL; 96 } 97 98 /* Check for inversion flags range */ 99 if (info->invflags & ~EBT_VLAN_MASK) { 100 pr_debug("inversion flags %2X is out of mask (%2X)\n", 101 info->invflags, EBT_VLAN_MASK); 102 return -EINVAL; 103 } 104 105 /* Reserved VLAN ID (VID) values 106 * ----------------------------- 107 * 0 - The null VLAN ID. 108 * 1 - The default Port VID (PVID) 109 * 0x0FFF - Reserved for implementation use. 110 * if_vlan.h: VLAN_N_VID 4096. 111 */ 112 if (GET_BITMASK(EBT_VLAN_ID)) { 113 if (!!info->id) { /* if id!=0 => check vid range */ 114 if (info->id > VLAN_N_VID) { 115 pr_debug("id %d is out of range (1-4096)\n", 116 info->id); 117 return -EINVAL; 118 } 119 /* Note: This is valid VLAN-tagged frame point. 120 * Any value of user_priority are acceptable, 121 * but should be ignored according to 802.1Q Std. 122 * So we just drop the prio flag. 123 */ 124 info->bitmask &= ~EBT_VLAN_PRIO; 125 } 126 /* Else, id=0 (null VLAN ID) => user_priority range (any?) */ 127 } 128 129 if (GET_BITMASK(EBT_VLAN_PRIO)) { 130 if ((unsigned char) info->prio > 7) { 131 pr_debug("prio %d is out of range (0-7)\n", 132 info->prio); 133 return -EINVAL; 134 } 135 } 136 /* Check for encapsulated proto range - it is possible to be 137 * any value for u_short range. 138 * if_ether.h: ETH_ZLEN 60 - Min. octets in frame sans FCS 139 */ 140 if (GET_BITMASK(EBT_VLAN_ENCAP)) { 141 if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) { 142 pr_debug("encap frame length %d is less than " 143 "minimal\n", ntohs(info->encap)); 144 return -EINVAL; 145 } 146 } 147 148 return 0; 149 } 150 151 static struct xt_match ebt_vlan_mt_reg __read_mostly = { 152 .name = "vlan", 153 .revision = 0, 154 .family = NFPROTO_BRIDGE, 155 .match = ebt_vlan_mt, 156 .checkentry = ebt_vlan_mt_check, 157 .matchsize = sizeof(struct ebt_vlan_info), 158 .me = THIS_MODULE, 159 }; 160 161 static int __init ebt_vlan_init(void) 162 { 163 pr_debug("ebtables 802.1Q extension module v" MODULE_VERS "\n"); 164 return xt_register_match(&ebt_vlan_mt_reg); 165 } 166 167 static void __exit ebt_vlan_fini(void) 168 { 169 xt_unregister_match(&ebt_vlan_mt_reg); 170 } 171 172 module_init(ebt_vlan_init); 173 module_exit(ebt_vlan_fini); 174