1 /* 2 * Description: EBTables 802.1Q match extension kernelspace module. 3 * Authors: Nick Fedchik <nick@fedchik.org.ua> 4 * Bart De Schuymer <bdschuym@pandora.be> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include <linux/if_ether.h> 21 #include <linux/if_vlan.h> 22 #include <linux/module.h> 23 #include <linux/moduleparam.h> 24 #include <linux/netfilter/x_tables.h> 25 #include <linux/netfilter_bridge/ebtables.h> 26 #include <linux/netfilter_bridge/ebt_vlan.h> 27 28 #define MODULE_VERS "0.6" 29 30 MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>"); 31 MODULE_DESCRIPTION("Ebtables: 802.1Q VLAN tag match"); 32 MODULE_LICENSE("GPL"); 33 34 #define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_ 35 #define EXIT_ON_MISMATCH(_MATCH_,_MASK_) {if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return false; } 36 37 static bool 38 ebt_vlan_mt(const struct sk_buff *skb, struct xt_action_param *par) 39 { 40 const struct ebt_vlan_info *info = par->matchinfo; 41 42 unsigned short TCI; /* Whole TCI, given from parsed frame */ 43 unsigned short id; /* VLAN ID, given from frame TCI */ 44 unsigned char prio; /* user_priority, given from frame TCI */ 45 /* VLAN encapsulated Type/Length field, given from orig frame */ 46 __be16 encap; 47 48 if (skb_vlan_tag_present(skb)) { 49 TCI = skb_vlan_tag_get(skb); 50 encap = skb->protocol; 51 } else { 52 const struct vlan_hdr *fp; 53 struct vlan_hdr _frame; 54 55 fp = skb_header_pointer(skb, 0, sizeof(_frame), &_frame); 56 if (fp == NULL) 57 return false; 58 59 TCI = ntohs(fp->h_vlan_TCI); 60 encap = fp->h_vlan_encapsulated_proto; 61 } 62 63 /* Tag Control Information (TCI) consists of the following elements: 64 * - User_priority. The user_priority field is three bits in length, 65 * interpreted as a binary number. 66 * - Canonical Format Indicator (CFI). The Canonical Format Indicator 67 * (CFI) is a single bit flag value. Currently ignored. 68 * - VLAN Identifier (VID). The VID is encoded as 69 * an unsigned binary number. 70 */ 71 id = TCI & VLAN_VID_MASK; 72 prio = (TCI >> 13) & 0x7; 73 74 /* Checking VLAN Identifier (VID) */ 75 if (GET_BITMASK(EBT_VLAN_ID)) 76 EXIT_ON_MISMATCH(id, EBT_VLAN_ID); 77 78 /* Checking user_priority */ 79 if (GET_BITMASK(EBT_VLAN_PRIO)) 80 EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO); 81 82 /* Checking Encapsulated Proto (Length/Type) field */ 83 if (GET_BITMASK(EBT_VLAN_ENCAP)) 84 EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP); 85 86 return true; 87 } 88 89 static int ebt_vlan_mt_check(const struct xt_mtchk_param *par) 90 { 91 struct ebt_vlan_info *info = par->matchinfo; 92 const struct ebt_entry *e = par->entryinfo; 93 94 /* Is it 802.1Q frame checked? */ 95 if (e->ethproto != htons(ETH_P_8021Q)) { 96 pr_debug("passed entry proto %2.4X is not 802.1Q (8100)\n", 97 ntohs(e->ethproto)); 98 return -EINVAL; 99 } 100 101 /* Check for bitmask range 102 * True if even one bit is out of mask 103 */ 104 if (info->bitmask & ~EBT_VLAN_MASK) { 105 pr_debug("bitmask %2X is out of mask (%2X)\n", 106 info->bitmask, EBT_VLAN_MASK); 107 return -EINVAL; 108 } 109 110 /* Check for inversion flags range */ 111 if (info->invflags & ~EBT_VLAN_MASK) { 112 pr_debug("inversion flags %2X is out of mask (%2X)\n", 113 info->invflags, EBT_VLAN_MASK); 114 return -EINVAL; 115 } 116 117 /* Reserved VLAN ID (VID) values 118 * ----------------------------- 119 * 0 - The null VLAN ID. 120 * 1 - The default Port VID (PVID) 121 * 0x0FFF - Reserved for implementation use. 122 * if_vlan.h: VLAN_N_VID 4096. 123 */ 124 if (GET_BITMASK(EBT_VLAN_ID)) { 125 if (!!info->id) { /* if id!=0 => check vid range */ 126 if (info->id > VLAN_N_VID) { 127 pr_debug("id %d is out of range (1-4096)\n", 128 info->id); 129 return -EINVAL; 130 } 131 /* Note: This is valid VLAN-tagged frame point. 132 * Any value of user_priority are acceptable, 133 * but should be ignored according to 802.1Q Std. 134 * So we just drop the prio flag. 135 */ 136 info->bitmask &= ~EBT_VLAN_PRIO; 137 } 138 /* Else, id=0 (null VLAN ID) => user_priority range (any?) */ 139 } 140 141 if (GET_BITMASK(EBT_VLAN_PRIO)) { 142 if ((unsigned char) info->prio > 7) { 143 pr_debug("prio %d is out of range (0-7)\n", 144 info->prio); 145 return -EINVAL; 146 } 147 } 148 /* Check for encapsulated proto range - it is possible to be 149 * any value for u_short range. 150 * if_ether.h: ETH_ZLEN 60 - Min. octets in frame sans FCS 151 */ 152 if (GET_BITMASK(EBT_VLAN_ENCAP)) { 153 if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) { 154 pr_debug("encap frame length %d is less than " 155 "minimal\n", ntohs(info->encap)); 156 return -EINVAL; 157 } 158 } 159 160 return 0; 161 } 162 163 static struct xt_match ebt_vlan_mt_reg __read_mostly = { 164 .name = "vlan", 165 .revision = 0, 166 .family = NFPROTO_BRIDGE, 167 .match = ebt_vlan_mt, 168 .checkentry = ebt_vlan_mt_check, 169 .matchsize = sizeof(struct ebt_vlan_info), 170 .me = THIS_MODULE, 171 }; 172 173 static int __init ebt_vlan_init(void) 174 { 175 pr_debug("ebtables 802.1Q extension module v" MODULE_VERS "\n"); 176 return xt_register_match(&ebt_vlan_mt_reg); 177 } 178 179 static void __exit ebt_vlan_fini(void) 180 { 181 xt_unregister_match(&ebt_vlan_mt_reg); 182 } 183 184 module_init(ebt_vlan_init); 185 module_exit(ebt_vlan_fini); 186