Updates to VLAN patches

index bf8b3a1..2d47f20 100644
@@ -422,7 +422,7 @@ static const char usage_message[] =
   "                  to a web server at host:port.\n"
 #endif
 #ifdef ENABLE_VLAN_TAGGING
-  "--vlan-tagging  : Enable VLAN tagging.\n"
+  "--vlan-tagging  : Enable 802.1Q-based VLAN tagging.\n"
   "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
   "--vlan-pvid v   : Sets the Port VLAN Identifier. Defaults to 1.\n"
 #endif

index 72ef91a..1263342 100644
@@ -166,7 +166,7 @@ mroute_extract_addr_ipv4 (struct mroute_addr *src,
 
 static void mroute_copy_ether_to_addr(struct mroute_addr *maddr,
 				      const uint8_t *eth_addr,
-				      int16_t vid)
+				      uint16_t vid)
 {
   maddr->type = MR_ADDR_ETHER;
   maddr->netbits = 0;

@@ -185,7 +185,7 @@ mroute_extract_addr_ether (struct mroute_addr *src,
 			   struct mroute_addr *esrc,
 			   struct mroute_addr *edest,
 			   const struct buffer *buf,
-			   int16_t vid)
+			   uint16_t vid)
 {
   unsigned int ret = 0;
   if (BLEN (buf) >= (int) sizeof (struct openvpn_ethhdr))

@@ -323,7 +323,7 @@ mroute_addr_print_ex (const struct mroute_addr *ma,
 	case MR_ADDR_ETHER:
 	  buf_printf (&out, "%s", format_hex_ex (ma->addr, 6, 0, 1, ":", gc)); 
 #ifdef ENABLE_VLAN_TAGGING
-	  buf_printf (&out, "@%d", *(int16_t*)(ma->addr + 6));
+	  buf_printf (&out, "@%u", *(uint16_t*)(ma->addr + 6));
 #endif
 	  break;
 	case MR_ADDR_IPV4:

index ccf79ec..95ea443 100644
@@ -140,7 +140,7 @@ mroute_extract_addr_from_packet (struct mroute_addr *src,
 				 struct mroute_addr *edest,
 				 const struct buffer *buf,
 				 int tunnel_type,
-				 int16_t bcast_domain)
+				 uint16_t vid)
 {
   unsigned int mroute_extract_addr_ipv4 (struct mroute_addr *src,
 					 struct mroute_addr *dest,

@@ -151,13 +151,13 @@ mroute_extract_addr_from_packet (struct mroute_addr *src,
 					  struct mroute_addr *esrc,
 					  struct mroute_addr *edest,
 					  const struct buffer *buf,
-					  int16_t vid);
+					  uint16_t vid);
   unsigned int ret = 0;
   verify_align_4 (buf);
   if (tunnel_type == DEV_TYPE_TUN)
     ret = mroute_extract_addr_ipv4 (src, dest, buf);
   else if (tunnel_type == DEV_TYPE_TAP)
-    ret = mroute_extract_addr_ether (src, dest, esrc, edest, buf, bcast_domain);
+    ret = mroute_extract_addr_ether (src, dest, esrc, edest, buf, vid);
   return ret;
 }
 

index dfd23a3..1a8bbbf 100644
@@ -1761,7 +1761,7 @@ multi_bcast (struct multi_context *m,
 	     const struct buffer *buf,
 	     const struct multi_instance *sender_instance,
 	     const struct mroute_addr *sender_addr,
-	     int16_t vid)
+	     uint16_t vid)
 {
   struct hash_iterator hi;
   struct hash_element *he;

@@ -1934,10 +1934,10 @@ buf_filter_incoming_vlan_tags (const struct buffer *buf)
 
       if (ntohs (vlanhdr->tpid) == OPENVPN_ETH_P_8021Q)
         {
-	  const int16_t vid = vlanhdr_get_vid(vlanhdr);
+	  const uint16_t vid = vlanhdr_get_vid(vlanhdr);
 	  if (vid != 0)
 	    {
-	      msg (D_VLAN_DEBUG, "dropping tagged incoming frame, vid: %d", vid);
+	      msg (D_VLAN_DEBUG, "dropping tagged incoming frame, vid: %u", vid);
 	      return true;
 	    }
 	}

@@ -2063,9 +2063,9 @@ multi_process_incoming_link (struct multi_context *m, struct multi_instance *ins
 	  else if (TUNNEL_TYPE (m->top.c1.tuntap) == DEV_TYPE_TAP)
 	    {
 #ifdef ENABLE_VLAN_TAGGING
-	      int16_t vid = 0;
+	      uint16_t vid = 0;
 #else
-	      const int16_t vid = 0;
+	      const uint16_t vid = 0;
 #endif
 #ifdef ENABLE_PF
 	      struct mroute_addr edest;

@@ -2185,8 +2185,8 @@ remove_vlan_tag (const struct context *c, struct buffer *buf)
 {
   struct openvpn_ethhdr eth;
   struct openvpn_8021qhdr vlanhdr;
-  int16_t vid;
-  int16_t pcp;
+  uint16_t vid;
+  uint16_t pcp;
 
   if (BLEN (buf) < (sizeof (struct openvpn_8021qhdr)))
     goto drop;

@@ -2206,7 +2206,7 @@ remove_vlan_tag (const struct context *c, struct buffer *buf)
 	  goto drop;
 	}
 
-      msg (D_VLAN_DEBUG, "assuming pvid for frame without vlan-tag, pvid: %d (proto/len 0x%04x)",
+      msg (D_VLAN_DEBUG, "assuming pvid for frame without vlan-tag, pvid: %u (proto/len 0x%04x)",
 	   c->options.vlan_pvid, ntohs (vlanhdr.tpid));
       /* We return the global PVID as the VID for the untagged frame. */
       return c->options.vlan_pvid;

@@ -2223,7 +2223,7 @@ remove_vlan_tag (const struct context *c, struct buffer *buf)
 	{
 	  /* We only accept untagged frames or priority-tagged frames. So drop
 	     VLAN-tagged frames. */
-	  msg (D_VLAN_DEBUG, "dropping frame with vlan-tag, vid: %d (proto/len 0x%04x)",
+	  msg (D_VLAN_DEBUG, "dropping frame with vlan-tag, vid: %u (proto/len 0x%04x)",
 	       vid, ntohs (vlanhdr.proto));
 	  goto drop;
 	}

@@ -2236,7 +2236,7 @@ remove_vlan_tag (const struct context *c, struct buffer *buf)
     {
       /* VLAN-tagged without priority information. */
 
-      msg (D_VLAN_DEBUG, "removing vlan-tag from frame: vid: %d, wrapped proto/len: 0x%04x",
+      msg (D_VLAN_DEBUG, "removing vlan-tag from frame: vid: %u, wrapped proto/len: 0x%04x",
            vid, ntohs (vlanhdr.proto));
       memcpy (&eth, &vlanhdr, sizeof (eth));
       eth.proto = vlanhdr.proto;

@@ -2249,7 +2249,7 @@ remove_vlan_tag (const struct context *c, struct buffer *buf)
       /* VLAN-tagged _with_ priority information.  We turn this frame into
 	 a pure priority frame.  I.e. we clear out the VID but leave the rest
 	 of the header intact. */
-      msg (D_VLAN_DEBUG, "removing vlan-tag from priority frame: vid: %d, wrapped proto/len: 0x%04x, prio: %d",
+      msg (D_VLAN_DEBUG, "removing vlan-tag from priority frame: vid: %u, wrapped proto/len: 0x%04x, prio: %u",
            vid, ntohs (vlanhdr.proto), pcp);
       vlanhdr_set_vid (&vlanhdr, htons (0));
       memcpy (BPTR (buf), &vlanhdr, sizeof vlanhdr);

@@ -2307,7 +2307,7 @@ multi_prepend_vlan_tag (const struct context *c, struct buffer *buf)
 
   vlanhdr_set_vid (vlanhdr, htons (c->options.vlan_pvid));
 
-  msg (D_VLAN_DEBUG, "tagging frame: vid %d (wrapping proto/len: %04x)",
+  msg (D_VLAN_DEBUG, "tagging frame: vid %u (wrapping proto/len: %04x)",
        c->options.vlan_pvid, vlanhdr->proto);
   return;
 drop:

index 2d47f20..827b9f0 100644
@@ -5810,7 +5810,7 @@ add_option (struct options *options,
       if (options->vlan_pvid < OPENVPN_8021Q_MIN_VID ||
 	  options->vlan_pvid > OPENVPN_8021Q_MAX_VID)
 	{
-	  msg (msglevel, "the parameter of --vlan-pvid parameters must be >= %d and <= %d", OPENVPN_8021Q_MIN_VID, OPENVPN_8021Q_MAX_VID);
+	  msg (msglevel, "the parameter of --vlan-pvid parameters must be >= %u and <= %u", OPENVPN_8021Q_MIN_VID, OPENVPN_8021Q_MAX_VID);
 	  goto err;
 	}
     }

index 5c4851f..a278561 100644
@@ -522,7 +522,7 @@ struct options
 #ifdef ENABLE_VLAN_TAGGING
   bool vlan_tagging;
   enum vlan_acceptable_frames vlan_accept;
-  int vlan_pvid;
+  uint16_t vlan_pvid;
 #endif
 };
 

index 5c641ff..d8e5ea7 100644
@@ -227,7 +227,7 @@ void ipv4_packet_size_verify (const uint8_t *data,
 /*
  * Retrieve the Priority Code Point (PCP) from the IEEE 802.1Q header.
  */
-static inline int
+static inline uint16_t
 vlanhdr_get_pcp (const struct openvpn_8021qhdr *hdr)
 {
   return hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_PCP;

@@ -235,7 +235,7 @@ vlanhdr_get_pcp (const struct openvpn_8021qhdr *hdr)
 /*
  * Retrieve the Canonical Format Indicator (CFI) from the IEEE 802.1Q header.
  */
-static inline int
+static inline uint16_t
 vlanhdr_get_cfi (const struct openvpn_8021qhdr *hdr)
 {
   return hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_CFI;

@@ -243,7 +243,7 @@ vlanhdr_get_cfi (const struct openvpn_8021qhdr *hdr)
 /*
  * Retrieve the VLAN Identifier (VID) from the IEEE 802.1Q header.
  */
-static inline int
+static inline uint16_t
 vlanhdr_get_vid (const struct openvpn_8021qhdr *hdr)
 {
   return hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_VID;

@@ -253,7 +253,7 @@ vlanhdr_get_vid (const struct openvpn_8021qhdr *hdr)
  * Set the Priority Code Point (PCP) in an IEEE 802.1Q header.
  */
 static inline void
-vlanhdr_set_pcp (struct openvpn_8021qhdr *hdr, const int pcp)
+vlanhdr_set_pcp (struct openvpn_8021qhdr *hdr, const uint16_t pcp)
 {
   hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_PCP) | (pcp & OPENVPN_8021Q_MASK_PCP);
 }

@@ -261,7 +261,7 @@ vlanhdr_set_pcp (struct openvpn_8021qhdr *hdr, const int pcp)
  * Set the Canonical Format Indicator (CFI) in an IEEE 802.1Q header.
  */
 static inline void
-vlanhdr_set_cfi (struct openvpn_8021qhdr *hdr, const int cfi)
+vlanhdr_set_cfi (struct openvpn_8021qhdr *hdr, const uint16_t cfi)
 {
   hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_CFI) | (cfi & OPENVPN_8021Q_MASK_CFI);
 }

@@ -269,7 +269,7 @@ vlanhdr_set_cfi (struct openvpn_8021qhdr *hdr, const int cfi)
  * Set the VLAN Identifier (VID) in an IEEE 802.1Q header.
  */
 static inline void
-vlanhdr_set_vid (struct openvpn_8021qhdr *hdr, const int vid)
+vlanhdr_set_vid (struct openvpn_8021qhdr *hdr, const uint16_t vid)
 {
   hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_VID) | (vid & OPENVPN_8021Q_MASK_VID);
 }

index 1a8bbbf..83c5aa3 100644
@@ -1925,24 +1925,33 @@ multi_process_post (struct multi_context *m, struct multi_instance *mi, const un
 }
 
 #ifdef ENABLE_VLAN_TAGGING
-bool
+/*
+ * Decides whether or not to drop an ethernet frame.  VLAN-tagged frames are
+ * dropped.  All other frames are accepted.
+ *
+ * @param buf The ethernet frame.
+ * @return    Returns true if the frame should be dropped, false otherwise.
+ */
+static bool
 buf_filter_incoming_vlan_tags (const struct buffer *buf)
 {
-  if (BLEN (buf) >= (int) sizeof (struct openvpn_8021qhdr))
-    {
-      const struct openvpn_8021qhdr *vlanhdr = (const struct openvpn_8021qhdr *) BPTR (buf);
+  const struct openvpn_8021qhdr *vlanhdr;
+  uint16_t vid;
 
-      if (ntohs (vlanhdr->tpid) == OPENVPN_ETH_P_8021Q)
-        {
-	  const uint16_t vid = vlanhdr_get_vid(vlanhdr);
-	  if (vid != 0)
-	    {
-	      msg (D_VLAN_DEBUG, "dropping tagged incoming frame, vid: %u", vid);
-	      return true;
-	    }
-	}
-    }
-  return false;
+  if (BLEN (buf) < (int) sizeof (struct openvpn_8021qhdr))
+    return false; /* Frame too small.  */
+
+  vlanhdr = (const struct openvpn_8021qhdr *) BPTR (buf);
+
+  if (ntohs (vlanhdr->tpid) != OPENVPN_ETH_P_8021Q)
+    return false; /* Frame is untagged.  */
+
+  vid = vlanhdr_get_vid(vlanhdr);
+  if (vid == 0)
+    return false; /* Frame only priority-tagged.  */
+
+  msg (D_VLAN_DEBUG, "dropping VLAN-tagged incoming frame, vid: %u", vid);
+  return true;
 }
 #endif
 

index 83c5aa3..2f531c2 100644
@@ -2175,8 +2175,9 @@ multi_process_incoming_link (struct multi_context *m, struct multi_instance *ins
 #ifdef ENABLE_VLAN_TAGGING
 /*
  * For vlan_accept == VAF_ONLY_UNTAGGED_OR_PRIORITY:
- *   If a frame is VLAN-tagged, it is dropped.  Otherwise, the global
- *   vlan_pvid is returned as VID.
+ *   Only untagged frames and frames that are priority-tagged (VID == 0) are
+ *   accepted.  (This means that VLAN-tagged frames are dropped.)  For frames
+ *   that aren't dropped, the global vlan_pvid is returned as VID.
  *
  * For vlan_accept == VAF_ONLY_VLAN_TAGGED:
  *   If a frame is VLAN-tagged and contains no priority information, the

@@ -2188,6 +2189,10 @@ multi_process_incoming_link (struct multi_context *m, struct multi_instance *ins
  * For vlan_accept == VAF_ALL:
  *   Accepts both VLAN-tagged and untagged (or priority-tagged) frames and
  *   and handles them as described above.
+ *
+ * @param c   The global context.
+ * @param buf The ethernet frame.
+ * @return    Returns -1 if the frame is dropped or the VID if it is accepted.
  */
 static int16_t
 remove_vlan_tag (const struct context *c, struct buffer *buf)

index 64486de..5a9d3a6 100644
@@ -54,10 +54,10 @@ is_ipv4 (int tunnel_type, struct buffer *buf)
 	return false;
       eh = (const struct openvpn_ethhdr *) BPTR (buf);
       if (ntohs (eh->proto) == OPENVPN_ETH_P_8021Q) {
+        const struct openvpn_8021qhdr *evh;
         if (BLEN (buf) < (int)(sizeof (struct openvpn_8021qhdr)
 	    + sizeof (struct openvpn_iphdr)))
 	  return false;
-        const struct openvpn_8021qhdr *evh;
         evh = (const struct openvpn_8021qhdr *) BPTR (buf);
         if (ntohs (evh->proto) != OPENVPN_ETH_P_IPV4)
           return false;

index 2f531c2..b77791a 100644
@@ -1946,7 +1946,7 @@ buf_filter_incoming_vlan_tags (const struct buffer *buf)
   if (ntohs (vlanhdr->tpid) != OPENVPN_ETH_P_8021Q)
     return false; /* Frame is untagged.  */
 
-  vid = vlanhdr_get_vid(vlanhdr);
+  vid = vlanhdr_get_vid (vlanhdr);
   if (vid == 0)
     return false; /* Frame only priority-tagged.  */
 

@@ -2228,8 +2228,8 @@ remove_vlan_tag (const struct context *c, struct buffer *buf)
 
   /* Tagged packet. */
 
-  vid = ntohs (vlanhdr_get_vid (&vlanhdr));
-  pcp = ntohs (vlanhdr_get_pcp (&vlanhdr));
+  vid = vlanhdr_get_vid (&vlanhdr);
+  pcp = vlanhdr_get_pcp (&vlanhdr);
 
   if (c->options.vlan_accept == VAF_ONLY_UNTAGGED_OR_PRIORITY)
     {

@@ -2265,7 +2265,7 @@ remove_vlan_tag (const struct context *c, struct buffer *buf)
 	 of the header intact. */
       msg (D_VLAN_DEBUG, "removing vlan-tag from priority frame: vid: %u, wrapped proto/len: 0x%04x, prio: %u",
            vid, ntohs (vlanhdr.proto), pcp);
-      vlanhdr_set_vid (&vlanhdr, htons (0));
+      vlanhdr_set_vid (&vlanhdr, 0);
       memcpy (BPTR (buf), &vlanhdr, sizeof vlanhdr);
     }
 

@@ -2315,11 +2315,11 @@ multi_prepend_vlan_tag (const struct context *c, struct buffer *buf)
       memcpy (vlanhdr, &eth, sizeof eth);
       vlanhdr->tpid = htons (OPENVPN_ETH_P_8021Q);
       vlanhdr->proto = eth.proto;
-      vlanhdr_set_pcp (vlanhdr, htons (0));
-      vlanhdr_set_cfi (vlanhdr, htons (0));
+      vlanhdr_set_pcp (vlanhdr, 0);
+      vlanhdr_set_cfi (vlanhdr, 0);
     }
 
-  vlanhdr_set_vid (vlanhdr, htons (c->options.vlan_pvid));
+  vlanhdr_set_vid (vlanhdr, c->options.vlan_pvid);
 
   msg (D_VLAN_DEBUG, "tagging frame: vid %u (wrapping proto/len: %04x)",
        c->options.vlan_pvid, vlanhdr->proto);

index d8e5ea7..c1bd606 100644
@@ -226,52 +226,73 @@ void ipv4_packet_size_verify (const uint8_t *data,
 
 /*
  * Retrieve the Priority Code Point (PCP) from the IEEE 802.1Q header.
+ *
+ * @param hdr Pointer to the Ethernet header with IEEE 802.1Q tagging.
+ * @return    Returns the PCP in host byte order.
  */
 static inline uint16_t
 vlanhdr_get_pcp (const struct openvpn_8021qhdr *hdr)
 {
-  return hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_PCP;
+  return ntohs (hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_PCP);
 }
 /*
  * Retrieve the Canonical Format Indicator (CFI) from the IEEE 802.1Q header.
+ *
+ * @param hdr Pointer to the Ethernet header with IEEE 802.1Q tagging.
+ * @return    Returns the CFI in host byte order.
  */
 static inline uint16_t
 vlanhdr_get_cfi (const struct openvpn_8021qhdr *hdr)
 {
-  return hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_CFI;
+  return ntohs (hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_CFI);
 }
 /*
  * Retrieve the VLAN Identifier (VID) from the IEEE 802.1Q header.
+ *
+ * @param hdr Pointer to the Ethernet header with IEEE 802.1Q tagging.
+ * @return    Returns the VID in host byte order.
  */
 static inline uint16_t
 vlanhdr_get_vid (const struct openvpn_8021qhdr *hdr)
 {
-  return hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_VID;
+  return ntohs (hdr->pcp_cfi_vid & OPENVPN_8021Q_MASK_VID);
 }
 
 /*
  * Set the Priority Code Point (PCP) in an IEEE 802.1Q header.
+ *
+ * @param hdr Pointer to the Ethernet header with IEEE 802.1Q tagging.
+ * @param pcp The PCP to set (in host byte order).
  */
 static inline void
 vlanhdr_set_pcp (struct openvpn_8021qhdr *hdr, const uint16_t pcp)
 {
-  hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_PCP) | (pcp & OPENVPN_8021Q_MASK_PCP);
+  hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_PCP) |
+		     (htons (pcp) & OPENVPN_8021Q_MASK_PCP);
 }
 /*
  * Set the Canonical Format Indicator (CFI) in an IEEE 802.1Q header.
+ *
+ * @param hdr Pointer to the Ethernet header with IEEE 802.1Q tagging.
+ * @param cfi The CFI to set (in host byte order).
  */
 static inline void
 vlanhdr_set_cfi (struct openvpn_8021qhdr *hdr, const uint16_t cfi)
 {
-  hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_CFI) | (cfi & OPENVPN_8021Q_MASK_CFI);
+  hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_CFI) |
+		     (htons (cfi) & OPENVPN_8021Q_MASK_CFI);
 }
 /*
  * Set the VLAN Identifier (VID) in an IEEE 802.1Q header.
+ *
+ * @param hdr Pointer to the Ethernet header with IEEE 802.1Q tagging.
+ * @param vid The VID to set (in host byte order).
  */
 static inline void
 vlanhdr_set_vid (struct openvpn_8021qhdr *hdr, const uint16_t vid)
 {
-  hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_VID) | (vid & OPENVPN_8021Q_MASK_VID);
+  hdr->pcp_cfi_vid = (hdr->pcp_cfi_vid & ~OPENVPN_8021Q_MASK_VID) |
+		     (htons (vid) & OPENVPN_8021Q_MASK_VID);
 }
 #endif