[PATCH][ebtables] add 802.3 filtering support

Hi Dave,

The patch below is from Chris Vitale <csv-GeuMkHXKC5pWk0Htik3J/[email protected]>.
It adds filtering support for 802.3 frames passing a bridge.

Please apply,
Bart

--- linux-2.6.0-test4/net/bridge/netfilter/Kconfig.old	2003-08-30 20:05:50.000000000 +0200
+++ linux-2.6.0-test4/net/bridge/netfilter/Kconfig	2003-08-30 20:07:13.000000000 +0200
@@ -50,6 +50,15 @@ config BRIDGE_EBT_T_NAT
 #
 # matches
 #
+config BRIDGE_EBT_802_3
+	tristate "ebt: 802.3 filter support"
+	depends on BRIDGE_NF_EBTABLES
+	help
+	  This option adds matching support for 802.3 Ethernet frames.
+
+	  If you want to compile it as a module, say M here and read
+	  <file:Documentation/modules.txt>.  If unsure, say `N'.
+
 config BRIDGE_EBT_ARP
 	tristate "ebt: ARP filter support"
 	depends on BRIDGE_NF_EBTABLES
--- linux-2.6.0-test4/net/bridge/netfilter/Makefile.old	2003-08-30 20:05:58.000000000 +0200
+++ linux-2.6.0-test4/net/bridge/netfilter/Makefile	2003-08-30 20:07:42.000000000 +0200
@@ -10,6 +10,7 @@ obj-$(CONFIG_BRIDGE_EBT_T_FILTER) += ebt
 obj-$(CONFIG_BRIDGE_EBT_T_NAT) += ebtable_nat.o
 
 #matches
+obj-$(CONFIG_BRIDGE_EBT_802_3) += ebt_802_3.o
 obj-$(CONFIG_BRIDGE_EBT_ARP) += ebt_arp.o
 obj-$(CONFIG_BRIDGE_EBT_IP) += ebt_ip.o
 obj-$(CONFIG_BRIDGE_EBT_MARK) += ebt_mark_m.o
--- /dev/null	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.0-test4/net/bridge/netfilter/ebt_802_3.c	2003-08-30 19:52:24.000000000 +0200
@@ -0,0 +1,73 @@
+/*
+ * 802_3
+ *
+ * Author:
+ * Chris Vitale csv-GeuMkHXKC5pWk0Htik3J/[email protected]
+ *
+ * May 2003
+ * 
+ */
+
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_802_3.h>
+#include <linux/module.h>
+
+static int ebt_filter_802_3(const struct sk_buff *skb, const struct net_device *in,
+   const struct net_device *out, const void *data, unsigned int datalen)
+{
+	struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
+	struct ebt_802_3_hdr *hdr = (struct ebt_802_3_hdr *)skb->mac.ethernet;
+	uint16_t type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
+
+	if (info->bitmask & EBT_802_3_SAP) {
+		if (FWINV(info->sap != hdr->llc.ui.ssap, EBT_802_3_SAP)) 
+				return EBT_NOMATCH;
+		if (FWINV(info->sap != hdr->llc.ui.dsap, EBT_802_3_SAP))
+				return EBT_NOMATCH;
+	}
+
+	if (info->bitmask & EBT_802_3_TYPE) {
+		if (!(hdr->llc.ui.dsap == CHECK_TYPE && hdr->llc.ui.ssap == CHECK_TYPE))
+			return EBT_NOMATCH;
+		if (FWINV(info->type != type, EBT_802_3_TYPE)) 
+			return EBT_NOMATCH;
+	}
+
+	return EBT_MATCH;
+}
+
+static struct ebt_match filter_802_3;
+static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
+   const struct ebt_entry *e, void *data, unsigned int datalen)
+{
+	struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
+
+	if (datalen < sizeof(struct ebt_802_3_info))
+		return -EINVAL;
+	if (info->bitmask & ~EBT_802_3_MASK || info->invflags & ~EBT_802_3_MASK)
+		return -EINVAL;
+
+	return 0;
+}
+
+static struct ebt_match filter_802_3 =
+{
+	.name		= EBT_802_3_MATCH,
+	.match		= ebt_filter_802_3,
+	.check		= ebt_802_3_check,
+	.me		= THIS_MODULE,
+};
+
+static int __init init(void)
+{
+	return ebt_register_match(&filter_802_3);
+}
+
+static void __exit fini(void)
+{
+	ebt_unregister_match(&filter_802_3);
+}
+
+module_init(init);
+module_exit(fini);
+MODULE_LICENSE("GPL");
--- /dev/null	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.0-test4/include/linux/netfilter_bridge/ebt_802_3.h	2003-08-30 19:52:49.000000000 +0200
@@ -0,0 +1,60 @@
+#ifndef __LINUX_BRIDGE_EBT_802_3_H
+#define __LINUX_BRIDGE_EBT_802_3_H
+
+#define EBT_802_3_SAP 0x01
+#define EBT_802_3_TYPE 0x02
+
+#define EBT_802_3_MATCH "802_3"
+
+/*
+ * If frame has DSAP/SSAP value 0xaa you must check the SNAP type
+ * to discover what kind of packet we're carrying. 
+ */
+#define CHECK_TYPE 0xaa
+
+/*
+ * Control field may be one or two bytes.  If the first byte has
+ * the value 0x03 then the entire length is one byte, otherwise it is two.
+ * One byte controls are used in Unnumbered Information frames.
+ * Two byte controls are used in Numbered Information frames.
+ */
+#define IS_UI 0x03
+
+#define EBT_802_3_MASK (EBT_802_3_SAP | EBT_802_3_TYPE | EBT_802_3)
+
+/* ui has one byte ctrl, ni has two */
+struct hdr_ui {
+	uint8_t dsap;
+	uint8_t ssap;
+	uint8_t ctrl;
+	uint8_t orig[3];
+	uint16_t type;
+};
+
+struct hdr_ni {
+	uint8_t dsap;
+	uint8_t ssap;
+	uint16_t ctrl;
+	uint8_t  orig[3];
+	uint16_t type;
+};
+
+struct ebt_802_3_hdr {
+	uint8_t  daddr[6];
+	uint8_t  saddr[6];
+	uint16_t len;
+	union {
+		struct hdr_ui ui;
+		struct hdr_ni ni;
+	} llc;
+};
+
+struct ebt_802_3_info 
+{
+	uint8_t  sap;
+	uint16_t type;
+	uint8_t  bitmask;
+	uint8_t  invflags;
+};
+
+#endif



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf