Patch by Wolfram Stering: ULE implementation, release 2

ULE is the Ultra Leightweight Encapsulation for encoding IP, IPv6, MPLS, you
name it..., into MPEG2 Transport Stream packets.  More information can be
found at the corresponding IETF working group 'ipdvb',
http://www.ietf.org/html.charters/ipdvb-charter.html

Changes from the last release include (all in dvb_net.c):
- implement the latest draft (draft-ietf-ipdvb-ule-03.txt), specifically
  the support for ULE extension headers.
- bugfixes related to handling of error conditions (e.g. TEI bit set),
  including bugs reported by Moritz Vieth and Hanno Tersteegen from
  Fraunhofer Institute.  Thanks!
- actually support MAC address filtering, if MAC address is present in
  the ULE SNDUs (D-Bit _not_ set).

1 files changed, 322 insertions, 174 deletions

diff --git a/linux/drivers/media/dvb/dvb-core/dvb_net.c b/linux/drivers/media/dvb/dvb-core/dvb_net.c
index cc7ac4905..3609dba2b 100644
--- a/linux/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/linux/drivers/media/dvb/dvb-core/dvb_net.c
@@ -6,13 +6,13 @@
  * Copyright (C) 2002 Ralph Metzler <rjkm@metzlerbros.de>
  *
  * ULE Decapsulation code:
- * Copyright (C) 2003 gcs - Global Communication & Services GmbH.
- *                and Institute for Computer Sciences
- *                    Salzburg University.
- *                    Hilmar Linder <hlinder@cosy.sbg.ac.at>
- *                and Wolfram Stering <wstering@cosy.sbg.ac.at>
+ * Copyright (C) 2003, 2004 gcs - Global Communication & Services GmbH.
+ *                      and Department of Scientific Computing
+ *                          Paris Lodron University of Salzburg.
+ *                          Hilmar Linder <hlinder@cosy.sbg.ac.at>
+ *                      and Wolfram Stering <wstering@cosy.sbg.ac.at>
  *
- * ULE Decaps according to draft-fair-ipdvb-ule-01.txt.
+ * ULE Decaps according to draft-ietf-ipdvb-ule-03.txt.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -30,6 +30,30 @@
  * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
  */
 
+/*
+ * ULE ChangeLog:
+ * Feb 2004: hl/ws v1: Implementing draft-fair-ipdvb-ule-01.txt
+ *
+ * Dec 2004: hl/ws v2: Implementing draft-ietf-ipdvb-ule-03.txt:
+ *                       ULE Extension header handling.
+ *                     Bugreports by Moritz Vieth and Hanno Tersteegen,
+ *                       Fraunhofer Institute for Open Communication Systems
+ *                       Competence Center for Advanced Satellite Communications.
+ *                     Bugfixes and robustness improvements.
+ *                     Filtering on dest MAC addresses, if present (D-Bit = 0)
+ *                     ULE_DEBUG compile-time option.
+ */
+
+/*
+ * FIXME / TODO (dvb_net.c):
+ *
+ * Unloading does not work for 2.6.9 kernels: a refcount doesn't go to zero.
+ *
+ * TS_FEED callback is called once for every single TS cell although it is
+ * registered (in dvb_net_feed_start()) for 100 TS cells (used for dvb_net_ule()).
+ *
+ */
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
@@ -61,6 +85,10 @@ static inline __u32 iov_crc32( __u32 c, struct kvec *iov, unsigned int cnt )
 
 #define DVB_NET_MULTICAST_MAX 10
 
+#undef ULE_DEBUG
+
+#ifdef ULE_DEBUG
+
 #define isprint(c)	((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9'))
 
 static void hexdump( const unsigned char *buf, unsigned short len )
@@ -90,14 +118,15 @@ static void hexdump( const unsigned char *buf, unsigned short len )
 	}
 }
 
+#endif
 
 struct dvb_net_priv {
 	int in_use;
-        struct net_device_stats stats;
-        char name[6];
+	struct net_device_stats stats;
+	char name[6];
 	u16 pid;
 	struct dvb_net *host;
-        struct dmx_demux *demux;
+	struct dmx_demux *demux;
 	struct dmx_section_feed *secfeed;
 	struct dmx_section_filter *secfilter;
 	struct dmx_ts_feed *tsfeed;
@@ -111,18 +140,19 @@ struct dvb_net_priv {
 #define RX_MODE_PROMISC 3
 	struct work_struct set_multicast_list_wq;
 	struct work_struct restart_net_feed_wq;
-	unsigned char feedtype;
-	int need_pusi;
-	unsigned char tscc;			/* TS continuity counter after sync. */
-	struct sk_buff *ule_skb;
-	unsigned short ule_sndu_len;
-	unsigned short ule_sndu_type;
-	unsigned char ule_sndu_type_1;
-	unsigned char ule_dbit;			/* whether the DestMAC address present
-						 * bit is set or not. */
-	unsigned char ule_ethhdr_complete;	/* whether we have completed the Ethernet
-						 * header for the current ULE SNDU. */
-	int ule_sndu_remain;
+	unsigned char feedtype;			/* Either FEED_TYPE_ or FEED_TYPE_ULE */
+	int need_pusi;				/* Set to 1, if synchronization on PUSI required. */
+	unsigned char tscc;			/* TS continuity counter after sync on PUSI. */
+	struct sk_buff *ule_skb;		/* ULE SNDU decodes into this buffer. */
+	unsigned char *ule_next_hdr;		/* Pointer into skb to next ULE extension header. */
+	unsigned short ule_sndu_len;		/* ULE SNDU length in bytes, w/o D-Bit. */
+	unsigned short ule_sndu_type;		/* ULE SNDU type field, complete. */
+	unsigned char ule_sndu_type_1;		/* ULE SNDU type field, if split across 2 TS cells. */
+	unsigned char ule_dbit;			/* Whether the DestMAC address present
+						 * or not (bit is set). */
+	unsigned char ule_bridged;		/* Whether the ULE_BRIDGED extension header was found. */
+	int ule_sndu_remain;			/* Nr. of bytes still required for current ULE SNDU. */
+	unsigned long ts_count;			/* Current ts cell counter. */
 };
 
 
@@ -178,78 +208,194 @@ static unsigned short dvb_net_eth_type_trans(struct sk_buff *skb,
 #define TS_SZ	188
 #define TS_SYNC	0x47
 #define TS_TEI	0x80
+#define TS_SC	0xC0
 #define TS_PUSI	0x40
 #define TS_AF_A	0x20
 #define TS_AF_D	0x10
 
+/* ULE Extension Header handlers. */
+
 #define ULE_TEST	0
 #define ULE_BRIDGED	1
-#define ULE_LLC		2
 
+int ule_test_sndu( struct dvb_net_priv *p )
+{
+	return -1;
+}
+
+int ule_bridged_sndu( struct dvb_net_priv *p )
+{
+	/* BRIDGE SNDU handling sucks in draft-ietf-ipdvb-ule-03.txt.
+	 * This has to be the last extension header, otherwise it won't work.
+	 * Blame the authors!
+	 */ 
+	p->ule_bridged = 1;
+	return 0;
+}
+
+
+/** Handle ULE extension headers.
+ *  Function is called after a successful CRC32 verification of an ULE SNDU to complete its decoding.
+ *  Returns: >= 0: nr. of bytes consumed by next extension header
+ *  	     -1:   Mandatory extension header that is not recognized or TEST SNDU; discard.
+ */
+static int handle_one_ule_extension( struct dvb_net_priv *p )
+{
+	/* Table of mandatory extension header handlers.  The header type is the index. */
+	static int (*ule_mandatory_ext_handlers[255])( struct dvb_net_priv *p ) =
+		{ [0] = ule_test_sndu, [1] = ule_bridged_sndu, [2] = NULL,  };
+
+	/* Table of optional extension header handlers.  The header type is the index. */
+	static int (*ule_optional_ext_handlers[255])( struct dvb_net_priv *p ) = { NULL, };
+
+	int ext_len = 0;
+	unsigned char hlen = (p->ule_sndu_type & 0x0700) >> 8;
+	unsigned char htype = p->ule_sndu_type & 0x00FF;
+
+	/* Discriminate mandatory and optional extension headers. */
+	if (hlen == 0) {
+		/* Mandatory extension header */
+		if (ule_mandatory_ext_handlers[htype]) {
+			ext_len = ule_mandatory_ext_handlers[htype]( p );
+			p->ule_next_hdr += ext_len;
+			if (! p->ule_bridged) {
+				p->ule_sndu_type = ntohs( *(unsigned short *)p->ule_next_hdr );
+				p->ule_next_hdr += 2;
+			} else {
+				p->ule_sndu_type = ntohs( *(unsigned short *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN)) );
+				/* This assures the extension handling loop will terminate. */
+			}
+		} else
+			ext_len = -1;	/* SNDU has to be discarded. */
+	} else {
+		/* Optional extension header.  Calculate the length. */
+		ext_len = hlen << 2;
+		/* Process the optional extension header according to its type. */
+		if (ule_optional_ext_handlers[htype])
+			(void)ule_optional_ext_handlers[htype]( p );
+		p->ule_next_hdr += ext_len;
+		p->ule_sndu_type = ntohs( *(unsigned short *)p->ule_next_hdr );
+		p->ule_next_hdr += 2;
+	}
+
+	return ext_len;
+}
+
+static int handle_ule_extensions( struct dvb_net_priv *p )
+{
+	int total_ext_len = 0, l;
+
+	p->ule_next_hdr = p->ule_skb->data;
+	do {
+		l = handle_one_ule_extension( p );
+		if (l == -1) return -1;	/* Stop extension header processing and discard SNDU. */
+		total_ext_len += l;
+
+	} while (p->ule_sndu_type < 1536);
+
+	return total_ext_len;
+}
+
+
+/** Prepare for a new ULE SNDU: reset the decoder state. */
 static inline void reset_ule( struct dvb_net_priv *p )
 {
 	p->ule_skb = NULL;
+	p->ule_next_hdr = NULL;
 	p->ule_sndu_len = 0;
 	p->ule_sndu_type = 0;
 	p->ule_sndu_type_1 = 0;
 	p->ule_sndu_remain = 0;
 	p->ule_dbit = 0xFF;
-	p->ule_ethhdr_complete = 0;
+	p->ule_bridged = 0;
 }
 
-static const char eth_dest_addr[] = { 0x0b, 0x0a, 0x09, 0x08, 0x04, 0x03 };
-
+/**
+ * Decode ULE SNDUs according to draft-ietf-ipdvb-ule-03.txt from a sequence of
+ * TS cells of a single PID.
+ */
 static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 {
 	struct dvb_net_priv *priv = (struct dvb_net_priv *)dev->priv;
-	unsigned long skipped = 0L, skblen = 0L;
+	unsigned long skipped = 0L;
 	u8 *ts, *ts_end, *from_where = NULL, ts_remain = 0, how_much = 0, new_ts = 1;
 	struct ethhdr *ethh = NULL;
-	unsigned int emergency_count = 0;
+
+#ifdef ULE_DEBUG
+	/* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
+	static unsigned char ule_hist[100*TS_SZ];
+	static unsigned char *ule_where = ule_hist, ule_dump = 0;
+#endif
 
 	if (dev == NULL) {
 		printk( KERN_ERR "NO netdev struct!\n" );
 		return;
 	}
 
-	for (ts = (char *)buf, ts_end = (char *)buf + buf_len; ts < ts_end; ) {
-
-		if (emergency_count++ > 200) {
-			/* Huh?? */
-			hexdump(ts, TS_SZ);
-			printk(KERN_WARNING "*** LOOP ALERT! ts %p ts_remain %u "
-				"how_much %u, ule_skb %p, ule_len %u, ule_remain %u\n",
-				ts, ts_remain, how_much, priv->ule_skb,
-				priv->ule_sndu_len, priv->ule_sndu_remain);
-			break;
-		}
+	/* For all TS cells in current buffer.
+	 * Appearently, we are called for every single TS cell.
+	 */
+	for (ts = (char *)buf, ts_end = (char *)buf + buf_len; ts < ts_end; /* no default incr. */ ) {
 
 		if (new_ts) {
-			if ((ts[0] != TS_SYNC) || (ts[1] & TS_TEI)) {
-				printk(KERN_WARNING "Invalid TS cell: SYNC %#x, TEI %u.\n",
-				       ts[0], ts[1] & TS_TEI >> 7);
+			/* We are about to process a new TS cell. */
+
+#ifdef ULE_DEBUG
+			if (ule_where >= &ule_hist[100*TS_SZ]) ule_where = ule_hist;
+			memcpy( ule_where, ts, TS_SZ );
+			if (ule_dump) {
+				hexdump( ule_where, TS_SZ );
+				ule_dump = 0;
+			}
+			ule_where += TS_SZ;
+#endif
+
+			/* Check TS error conditions: sync_byte, transport_error_indicator, scrambling_control . */
+			if ((ts[0] != TS_SYNC) || (ts[1] & TS_TEI) || ((ts[3] & TS_SC) != 0)) {
+				printk(KERN_WARNING "%lu: Invalid TS cell: SYNC %#x, TEI %u, SC %#x.\n",
+				       priv->ts_count, ts[0], ts[1] & TS_TEI >> 7, ts[3] & 0xC0 >> 6);
+
+				/* Drop partly decoded SNDU, reset state, resync on PUSI. */
+				if (priv->ule_skb) {
+					dev_kfree_skb( priv->ule_skb );
+					/* Prepare for next SNDU. */
+					((struct dvb_net_priv *) dev->priv)->stats.rx_errors++;
+					((struct dvb_net_priv *) dev->priv)->stats.rx_frame_errors++;
+				}
+				reset_ule(priv);
+				priv->need_pusi = 1;
+
+				/* Continue with next TS cell. */
+				ts += TS_SZ;
+				priv->ts_count++;
 				continue;
 			}
+
 			ts_remain = 184;
 			from_where = ts + 4;
 		}
 		/* Synchronize on PUSI, if required. */
 		if (priv->need_pusi) {
 			if (ts[1] & TS_PUSI) {
-				/* Find beginning of first ULE SNDU in current TS cell.
-				 * priv->need_pusi = 0; */
+				/* Find beginning of first ULE SNDU in current TS cell. */
+				/* Synchronize continuity counter. */
 				priv->tscc = ts[3] & 0x0F;
 				/* There is a pointer field here. */
 				if (ts[4] > ts_remain) {
-					printk(KERN_ERR "Invalid ULE packet "
-					       "(pointer field %d)\n", ts[4]);
+					printk(KERN_ERR "%lu: Invalid ULE packet "
+					       "(pointer field %d)\n", priv->ts_count, ts[4]);
+					ts += TS_SZ;
+					priv->ts_count++;
 					continue;
 				}
+				/* Skip to destination of pointer field. */
 				from_where = &ts[5] + ts[4];
 				ts_remain -= 1 + ts[4];
 				skipped = 0;
 			} else {
 				skipped++;
+				ts += TS_SZ;
+				priv->ts_count++;
 				continue;
 			}
 		}
@@ -260,32 +406,45 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 				priv->tscc = (priv->tscc + 1) & 0x0F;
 			else {
 				/* TS discontinuity handling: */
+				printk(KERN_WARNING "%lu: TS discontinuity: got %#x, "
+				       "exptected %#x.\n", priv->ts_count, ts[3] & 0x0F, priv->tscc);
+				/* Drop partly decoded SNDU, reset state, resync on PUSI. */
 				if (priv->ule_skb) {
 					dev_kfree_skb( priv->ule_skb );
 					/* Prepare for next SNDU. */
-					reset_ule(priv);
+					// reset_ule(priv);  moved to below.
 					((struct dvb_net_priv *) dev->priv)->stats.rx_errors++;
 					((struct dvb_net_priv *) dev->priv)->stats.rx_frame_errors++;
 				}
+				reset_ule(priv);
 				/* skip to next PUSI. */
-				printk(KERN_WARNING "TS discontinuity: got %#x, "
-				       "exptected %#x.\n", ts[3] & 0x0F, priv->tscc);
 				priv->need_pusi = 1;
+				ts += TS_SZ;
+				priv->ts_count++;
 				continue;
 			}
 			/* If we still have an incomplete payload, but PUSI is
-			 * set, some TS cells are missing.
+			 * set; some TS cells are missing.
 			 * This is only possible here, if we missed exactly 16 TS
-			 * cells (continuity counter). */
+			 * cells (continuity counter wrap). */
 			if (ts[1] & TS_PUSI) {
 				if (! priv->need_pusi) {
-					/* printk(KERN_WARNING "Skipping pointer field %u.\n", *from_where); */
 					if (*from_where > 181) {
-						printk(KERN_WARNING "*** Invalid pointer "
-						       "field: %u.  Current TS cell "
-						       "follows:\n", *from_where);
-						hexdump( ts, TS_SZ );
-						printk(KERN_WARNING "-------------------\n");
+						/* Pointer field is invalid.  Drop this TS cell and any started ULE SNDU. */
+						printk(KERN_WARNING "%lu: Invalid pointer "
+						       "field: %u.\n", priv->ts_count, *from_where);
+
+						/* Drop partly decoded SNDU, reset state, resync on PUSI. */
+						if (priv->ule_skb) {
+							dev_kfree_skb( priv->ule_skb );
+							((struct dvb_net_priv *) dev->priv)->stats.rx_errors++;
+							((struct dvb_net_priv *) dev->priv)->stats.rx_frame_errors++;
+						}
+						reset_ule(priv);
+						priv->need_pusi = 1;
+						ts += TS_SZ;
+						priv->ts_count++;
+						continue;
 					}
 					/* Skip pointer field (we're processing a
 					 * packed payload). */
@@ -295,21 +454,26 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 					priv->need_pusi = 0;
 
 				if (priv->ule_sndu_remain > 183) {
+					/* Current SNDU lacks more data than there could be available in the
+					 * current TS cell. */
 					((struct dvb_net_priv *) dev->priv)->stats.rx_errors++;
 					((struct dvb_net_priv *) dev->priv)->stats.rx_length_errors++;
-					printk(KERN_WARNING "Expected %d more SNDU bytes, but "
-					       "got PUSI.  Flushing incomplete payload.\n",
-					       priv->ule_sndu_remain);
+					printk(KERN_WARNING "%lu: Expected %d more SNDU bytes, but "
+					       "got PUSI (pf %d, ts_remain %d).  Flushing incomplete payload.\n",
+					       priv->ts_count, priv->ule_sndu_remain, ts[4], ts_remain);
 					dev_kfree_skb(priv->ule_skb);
 					/* Prepare for next SNDU. */
 					reset_ule(priv);
+					/* Resync: go to where pointer field points to: start of next ULE SNDU. */
+					from_where += ts[4];
+					ts_remain -= ts[4];
 				}
 			}
 		}
 
 		/* Check if new payload needs to be started. */
 		if (priv->ule_skb == NULL) {
-			/* Start a new payload w/ skb.
+			/* Start a new payload with skb.
 			 * Find ULE header.  It is only guaranteed that the
 			 * length field (2 bytes) is contained in the current
 			 * TS.
@@ -323,6 +487,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 			}
 
 			if (! priv->ule_sndu_len) {
+				/* Got at least two bytes, thus extrace the SNDU length. */
 				priv->ule_sndu_len = from_where[0] << 8 | from_where[1];
 				if (priv->ule_sndu_len & 0x8000) {
 					/* D-Bit is set: no dest mac present. */
@@ -331,17 +496,14 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 				} else
 					priv->ule_dbit = 0;
 
-				/* printk(KERN_WARNING "ULE D-Bit: %d, SNDU len %u.\n",
-				          priv->ule_dbit, priv->ule_sndu_len); */
-
 				if (priv->ule_sndu_len > 32763) {
-					printk(KERN_WARNING "Invalid ULE SNDU length %u. "
-					       "Resyncing.\n", priv->ule_sndu_len);
-					hexdump(ts, TS_SZ);
+					printk(KERN_WARNING "%lu: Invalid ULE SNDU length %u. "
+					       "Resyncing.\n", priv->ts_count, priv->ule_sndu_len);
 					priv->ule_sndu_len = 0;
 					priv->need_pusi = 1;
 					new_ts = 1;
 					ts += TS_SZ;
+					priv->ts_count++;
 					continue;
 				}
 				ts_remain -= 2;	/* consume the 2 bytes SNDU length. */
@@ -359,11 +521,12 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 				case 1:
 					priv->ule_sndu_type = from_where[0] << 8;
 					priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
-					/* ts_remain -= 1; from_where += 1;
-					 *   here not necessary, because we continue. */
+					ts_remain -= 1; from_where += 1;
+					/* Continue w/ next TS. */
 				case 0:
 					new_ts = 1;
 					ts += TS_SZ;
+					priv->ts_count++;
 					continue;
 
 				default: /* complete ULE header is present in current TS. */
@@ -381,24 +544,9 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 					break;
 			}
 
-			if (priv->ule_sndu_type == ULE_TEST) {
-				/* Test SNDU, discarded by the receiver. */
-				printk(KERN_WARNING "Discarding ULE Test SNDU (%d bytes). "
-				       "Resyncing.\n", priv->ule_sndu_len);
-				priv->ule_sndu_len = 0;
-				priv->need_pusi = 1;
-				continue;
-			}
-
-			skblen = priv->ule_sndu_len;	/* Including CRC32 */
-			if (priv->ule_sndu_type != ULE_BRIDGED) {
-				skblen += ETH_HLEN;
-#if 1
-				if (! priv->ule_dbit)
-					skblen -= ETH_ALEN;
-#endif
-			}
-			priv->ule_skb = dev_alloc_skb(skblen);
+			/* Allocate the skb (decoder target buffer) with the correct size, as follows:
+			 * prepare for the largest case: bridged SNDU with MAC address (dbit = 0). */
+			priv->ule_skb = dev_alloc_skb( priv->ule_sndu_len + ETH_HLEN + ETH_ALEN );
 			if (priv->ule_skb == NULL) {
 				printk(KERN_NOTICE "%s: Memory squeeze, dropping packet.\n",
 				       dev->name);
@@ -406,130 +554,129 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 				return;
 			}
 
-#if 0
-			if (priv->ule_sndu_type != ULE_BRIDGED) {
-				// skb_reserve(priv->ule_skb, 2);    /* longword align L3 header */
-				// Create Ethernet header.
-				ethh = (struct ethhdr *)skb_put( priv->ule_skb, ETH_HLEN );
-				memset( ethh->h_source, 0x00, ETH_ALEN );
-				if (priv->ule_dbit) {
-					// Dest MAC address not present --> generate our own.
-					memcpy( ethh->h_dest, eth_dest_addr, ETH_ALEN );
-				} else {
-					// Dest MAC address could be split across two TS cells.
-					// FIXME: implement.
-
-					printk( KERN_WARNING "%s: got destination MAC "
-						"address.\n", dev->name );
-					memcpy( ethh->h_dest, eth_dest_addr, ETH_ALEN );
-				}
-				ethh->h_proto = htons(priv->ule_sndu_type == ULE_LLC ?
-						      priv->ule_sndu_len : priv->ule_sndu_type);
-			}
-#endif
-			/* this includes the CRC32 _and_ dest mac, if !dbit! */
+			/* This includes the CRC32 _and_ dest mac, if !dbit. */
 			priv->ule_sndu_remain = priv->ule_sndu_len;
 			priv->ule_skb->dev = dev;
+			/* Leave space for Ethernet or bridged SNDU header (eth hdr plus one MAC addr). */
+			skb_reserve( priv->ule_skb, ETH_HLEN + ETH_ALEN );
 		}
 
 		/* Copy data into our current skb. */
 		how_much = min(priv->ule_sndu_remain, (int)ts_remain);
-		if ((priv->ule_ethhdr_complete < ETH_ALEN) &&
-		    (priv->ule_sndu_type != ULE_BRIDGED)) {
-			ethh = (struct ethhdr *)priv->ule_skb->data;
-			if (! priv->ule_dbit) {
-				if (how_much >= (ETH_ALEN - priv->ule_ethhdr_complete)) {
-					/* copy dest mac address. */
-					memcpy(skb_put(priv->ule_skb,
-						       (ETH_ALEN - priv->ule_ethhdr_complete)),
-					       from_where,
-					       (ETH_ALEN - priv->ule_ethhdr_complete));
-					memset(ethh->h_source, 0x00, ETH_ALEN);
-					ethh->h_proto = htons(priv->ule_sndu_type == ULE_LLC ?
-							      priv->ule_sndu_len :
-							      priv->ule_sndu_type);
-					skb_put(priv->ule_skb, ETH_ALEN + 2);
-
-					how_much -= (ETH_ALEN - priv->ule_ethhdr_complete);
-					priv->ule_sndu_remain -= (ETH_ALEN -
-								  priv->ule_ethhdr_complete);
-					ts_remain -= (ETH_ALEN - priv->ule_ethhdr_complete);
-					from_where += (ETH_ALEN - priv->ule_ethhdr_complete);
-					priv->ule_ethhdr_complete = ETH_ALEN;
-				}
-			} else {
-				/* Generate whole Ethernet header. */
-				memcpy(ethh->h_dest, eth_dest_addr, ETH_ALEN);
-				memset(ethh->h_source, 0x00, ETH_ALEN);
-				ethh->h_proto = htons(priv->ule_sndu_type == ULE_LLC ?
-						      priv->ule_sndu_len : priv->ule_sndu_type);
-				skb_put(priv->ule_skb, ETH_HLEN);
-				priv->ule_ethhdr_complete = ETH_ALEN;
-			}
-		}
-		/* printk(KERN_WARNING "Copying %u bytes, ule_sndu_remain = %u, "
-		          "ule_sndu_len = %u.\n", how_much, priv->ule_sndu_remain,
-			  priv->ule_sndu_len); */
 		memcpy(skb_put(priv->ule_skb, how_much), from_where, how_much);
 		priv->ule_sndu_remain -= how_much;
 		ts_remain -= how_much;
 		from_where += how_much;
 
-		if ((priv->ule_ethhdr_complete < ETH_ALEN) &&
-		    (priv->ule_sndu_type != ULE_BRIDGED)) {
-			priv->ule_ethhdr_complete += how_much;
-		}
-
 		/* Check for complete payload. */
 		if (priv->ule_sndu_remain <= 0) {
 			/* Check CRC32, we've got it in our skb already. */
 			unsigned short ulen = htons(priv->ule_sndu_len);
 			unsigned short utype = htons(priv->ule_sndu_type);
-			struct kvec iov[4] = {
+			struct kvec iov[3] = {
 				{ &ulen, sizeof ulen },
 				{ &utype, sizeof utype },
-				{ NULL, 0 },
-				{ priv->ule_skb->data + ETH_HLEN,
-					priv->ule_skb->len - ETH_HLEN - 4 }
+				{ priv->ule_skb->data, priv->ule_skb->len - 4 }
 			};
 			unsigned long ule_crc = ~0L, expected_crc;
 			if (priv->ule_dbit) {
 				/* Set D-bit for CRC32 verification,
 				 * if it was set originally. */
 				ulen |= 0x0080;
-			} else {
-				iov[2].iov_base = priv->ule_skb->data;
-				iov[2].iov_len = ETH_ALEN;
 			}
-			ule_crc = iov_crc32(ule_crc, iov, 4);
+
+			ule_crc = iov_crc32(ule_crc, iov, 3);
 			expected_crc = *((u8 *)priv->ule_skb->tail - 4) << 24 |
-				*((u8 *)priv->ule_skb->tail - 3) << 16 |
-				*((u8 *)priv->ule_skb->tail - 2) << 8 |
-				*((u8 *)priv->ule_skb->tail - 1);
+				       *((u8 *)priv->ule_skb->tail - 3) << 16 |
+				       *((u8 *)priv->ule_skb->tail - 2) << 8 |
+				       *((u8 *)priv->ule_skb->tail - 1);
 			if (ule_crc != expected_crc) {
-				printk(KERN_WARNING "CRC32 check %s: %#lx / %#lx.\n",
-				       ule_crc != expected_crc ? "FAILED" : "OK",
-				       ule_crc, expected_crc);
-				hexdump(priv->ule_skb->data + ETH_HLEN,
-					priv->ule_skb->len - ETH_HLEN);
+				printk(KERN_WARNING "%lu: CRC32 check FAILED: %#lx / %#lx, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n",
+				       priv->ts_count, ule_crc, expected_crc, priv->ule_sndu_len, priv->ule_sndu_type, ts_remain, ts_remain > 2 ? *(unsigned short *)from_where : 0);
+
+#ifdef ULE_DEBUG
+				hexdump( iov[0].iov_base, iov[0].iov_len );
+				hexdump( iov[1].iov_base, iov[1].iov_len );
+				hexdump( iov[2].iov_base, iov[2].iov_len );
+
+				if (ule_where == ule_hist) {
+					hexdump( &ule_hist[98*TS_SZ], TS_SZ );
+					hexdump( &ule_hist[99*TS_SZ], TS_SZ );
+				} else if (ule_where == &ule_hist[TS_SZ]) {
+					hexdump( &ule_hist[99*TS_SZ], TS_SZ );
+					hexdump( ule_hist, TS_SZ );
+				} else {
+					hexdump( ule_where - TS_SZ - TS_SZ, TS_SZ );
+					hexdump( ule_where - TS_SZ, TS_SZ );
+				}
+				ule_dump = 1;
+#endif
 
 				((struct dvb_net_priv *) dev->priv)->stats.rx_errors++;
 				((struct dvb_net_priv *) dev->priv)->stats.rx_crc_errors++;
 				dev_kfree_skb(priv->ule_skb);
 			} else {
+				/* CRC32 verified OK. */
+				/* Handle ULE Extension Headers. */
+				if (priv->ule_sndu_type < 1536) {
+					/* There is an extension header.  Handle it accordingly. */
+					int l = handle_ule_extensions( priv );
+					if (l < 0) {
+						/* Mandatory extension header unknown or TEST SNDU.  Drop it. */
+						// printk( KERN_WARNING "Dropping SNDU, extension headers.\n" );
+						dev_kfree_skb( priv->ule_skb );
+						goto sndu_done;
+					}
+					skb_pull( priv->ule_skb, l );
+				}
+
 				/* CRC32 was OK. Remove it from skb. */
 				priv->ule_skb->tail -= 4;
 				priv->ule_skb->len -= 4;
+
+				/* Filter on receiver's destination MAC address, if present. */
+				if (!priv->ule_dbit) {
+					/* The destination MAC address is the next data in the skb. */
+					if (memcmp( priv->ule_skb->data, dev->dev_addr, ETH_ALEN )) {
+						/* MAC addresses don't match.  Drop SNDU. */
+						// printk( KERN_WARNING "Dropping SNDU, MAC address.\n" );
+						dev_kfree_skb( priv->ule_skb );
+						goto sndu_done;
+					}
+					if (! priv->ule_bridged) {
+						skb_push( priv->ule_skb, ETH_ALEN + 2 );
+						ethh = (struct ethhdr *)priv->ule_skb->data;
+						memcpy( ethh->h_dest, ethh->h_source, ETH_ALEN );
+						memset( ethh->h_source, 0, ETH_ALEN );
+						ethh->h_proto = htons( priv->ule_sndu_type );
+					} else {
+						/* Skip the Receiver destination MAC address. */
+						skb_pull( priv->ule_skb, ETH_ALEN );
+					}
+				} else {
+					if (! priv->ule_bridged) {
+						skb_push( priv->ule_skb, ETH_HLEN );
+						ethh = (struct ethhdr *)priv->ule_skb->data;
+						memcpy( ethh->h_dest, dev->dev_addr, ETH_ALEN );
+						memset( ethh->h_source, 0, ETH_ALEN );
+						ethh->h_proto = htons( priv->ule_sndu_type );
+					} else {
+						/* skb is in correct state; nothing to do. */
+					}
+				}
+				priv->ule_bridged = 0;
+
 				/* Stuff into kernel's protocol stack. */
 				priv->ule_skb->protocol = dvb_net_eth_type_trans(priv->ule_skb, dev);
 				/* If D-bit is set (i.e. destination MAC address not present),
-				 * receive the packet anyhw. */
-				/* if (priv->ule_dbit && skb->pkt_type == PACKET_OTHERHOST) */
-					priv->ule_skb->pkt_type = PACKET_HOST;
+				 * receive the packet anyhow. */
+				/* if (priv->ule_dbit && skb->pkt_type == PACKET_OTHERHOST)
+					priv->ule_skb->pkt_type = PACKET_HOST; */
 				((struct dvb_net_priv *) dev->priv)->stats.rx_packets++;
 				((struct dvb_net_priv *) dev->priv)->stats.rx_bytes += priv->ule_skb->len;
 				netif_rx(priv->ule_skb);
 			}
+			sndu_done:
 			/* Prepare for next SNDU. */
 			reset_ule(priv);
 		}
@@ -549,6 +696,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 		} else {
 			new_ts = 1;
 			ts += TS_SZ;
+			priv->ts_count++;
 			if (priv->ule_skb == NULL) {
 				priv->need_pusi = 1;
 				priv->ule_sndu_type_1 = 0;
@@ -728,7 +876,7 @@ static int dvb_net_feed_start(struct net_device *dev)
         unsigned char *mac = (unsigned char *) dev->dev_addr;
 
 	dprintk("%s: rx_mode %i\n", __FUNCTION__, priv->rx_mode);
-	if (priv->secfeed || priv->secfilter || priv->multi_secfilter[0])
+	if (priv->tsfeed || priv->secfeed || priv->secfilter || priv->multi_secfilter[0])
 		printk("%s: BUG %d\n", __FUNCTION__, __LINE__);
 
 	priv->secfeed=NULL;
@@ -1005,7 +1153,7 @@ static int get_if(struct dvb_net *dvbnet)
 
 static int dvb_net_add_if(struct dvb_net *dvbnet, u16 pid, u8 feedtype)
 {
-        struct net_device *net;
+	struct net_device *net;
 	struct dvb_net_priv *priv;
 	int result;
 	int if_num;
@@ -1028,8 +1176,8 @@ static int dvb_net_add_if(struct dvb_net *dvbnet, u16 pid, u8 feedtype)
 	dvbnet->device[if_num] = net;
 
 	priv = net->priv;
-        priv->demux = dvbnet->demux;
-        priv->pid = pid;
+	priv->demux = dvbnet->demux;
+	priv->pid = pid;
 	priv->rx_mode = RX_MODE_UNI;
 	priv->need_pusi = 1;
 	priv->tscc = 0;
@@ -1039,7 +1187,7 @@ static int dvb_net_add_if(struct dvb_net *dvbnet, u16 pid, u8 feedtype)
 	INIT_WORK(&priv->set_multicast_list_wq, wq_set_multicast_list, net);
 	INIT_WORK(&priv->restart_net_feed_wq, wq_restart_net_feed, net);
 
-        net->base_addr = pid;
+	net->base_addr = pid;
 
 	if ((result = register_netdev(net)) < 0) {
 		dvbnet->device[if_num] = NULL;
@@ -1047,7 +1195,7 @@ static int dvb_net_add_if(struct dvb_net *dvbnet, u16 pid, u8 feedtype)
 		return result;
 	}
 
-        return if_num;
+	return if_num;
 }
 
 static int dvb_net_remove_if(struct dvb_net *dvbnet, int num)