Re: ebt_vnat: Adding VLAN tag target

Jon Petralanda schreef:
> Hi! I'm trying to do a new target module for ebtables to add the VLAN 
> tag depending on some parameters with this kind of rule:
>
> # ebtables -t nat -A OUTPUT/POSTROUTING -s sourceMAC -j vnat --to-vlan
>
> Like Ashwin did it here: 
> http://osdir.com/ml/linux.network.bridge.ebtables.devel/2003-12/msg00026.html
>
> I'm using 2.6.22-15 kernel and ebtables-v2.0.8-1. I have copied the 
> dnat code on userspace and kernel and I have read the 
> vlan_dev.c/if_vlan.h codes and I have this on mi ebt_vnat_target function:
>
>  static int ebt_target_vnat(struct sk_buff **pskb, unsigned int hooknr,
>     const struct net_device *in, const struct net_device *out,
>     const void *data, unsigned int datalen)
>  {
>
>     struct ebt_nat_info *info = (struct ebt_nat_info *)data;
>     unsigned short veth_TCI = 0;
>     struct vlan_ethhdr *veth;
>
>     if (skb_headroom(*pskb) < VLAN_HLEN) {
>         struct sk_buff *sk_tmp = *pskb;
>         *pskb = skb_realloc_headroom(sk_tmp, VLAN_HLEN);
>         kfree_skb(sk_tmp);
>         if (*pskb == NULL) {
>             printk(KERN_ERR "vlan: failed to realloc headroom\n");
>             return EBT_DROP;
>         }
You shouldn't allow *pskb to be NULL. Only change *pskb if the 
reallocation worked.

>     } else {
>         *pskb = skb_unshare(*pskb, GFP_ATOMIC);
>         if (!*pskb) {
>             printk(KERN_ERR "vlan: failed to unshare skbuff\n");
>             return EBT_DROP;
>         }
>     }
Same comment as above.

>
>     veth = (struct vlan_ethhdr *)skb_push(*pskb, VLAN_HLEN);i
>
>     /* Move the mac addresses to the beginning of the new header. */
>     memmove((*pskb)->data, (*pskb)->data + VLAN_HLEN, 2 * VLAN_ETH_ALEN);
>
>     /* first, the ethernet type */
>     veth->h_vlan_proto = __constant_htons(ETH_P_8021Q);
>
>     /* now, the tag */
>     veth->h_vlan_TCI = htons(veth_TCI);
>
>     (*pskb)->protocol = __constant_htons(ETH_P_8021Q);
>     (*pskb)->mac_header -= VLAN_HLEN;
>     (*pskb)->network_header -= VLAN_HLEN;
>
>      return info->target;
>  }
>
> If I execute my target with the PREROUTING chain when I see some 
> strange packets on br0 with Wireshark (for example if I do a 98 bytes 
> ping to my computer I receive 102 bytes but the other things like 
> Ethertype or the source/destination MACs goes bad).
>
> If I execute it with OUTPUT... I have Kernel panic. I have tried 
> different combinations of commenting lines, adding some functions but 
> nothing.
>
Changing the protocol type in the middle of network processing will 
cause problems. The code in net/bridge/br_netfilter.c is probably 
causing the kernel panic. You should only do this kind of change very 
early. Try the BROUTING chain if PREROUTING keeps failing.

>
> My questions are:
>
> 1. How can I debug (with printks or something like that) the module to 
> see what its doing exactly line by line?
Follow the packet in the network code (you can eg mark it) and check if 
the header is what you intend it to be (if not, printk something).

> 2. It seems like I have to debug the kernel, do you know a form to 
> debug it more or less easily?
>
> 3. Do you know what I'm doing wrong on my target? It seems like the 
> code is apparently ok.
>
> PD: If the things goes well... Bart, are you interested on a patch of 
> this target adding the options of choosing an vlan-id and vlan-priority?
Depends how intrusive it is and if it's useful for other people. What 
exactly is the benefit of this and in what sense is it impossible to do 
this with routing and the vlan tool? Note that the kernel code has 
changed quite a bit since 2.6.22.

cheers,
Bart


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/