bridges, vlans, and xen, oh my!

[der Mouse <mouse%Rodents-Montreal.ORG@localhost>]

Conceptually, what I want is a vlan interface that selects for untagged
packets on input and does not add any tag on output (what my own 802.1q
implementation calls VLAN_NONE, if that means anything to anyone).

Using the underlying interface is not suitable.  This is because I want
to put this interface into a bridge, and I want to bridge only untagged
packets - tagged packets should go to the appropriate vlan interface
(if there is one) or be dropped (if not), never passed through the
bridge.

I'm using 4.0.  What would be involved?  Did I just miss something when
looking at 4.0's vlan stuff?  Or is there some other facility which has
equivalent effect?  Or does this require hacking on the vlan code?

(The mention of xen in the Subject: is there more to give me three
things to name than because it's really relevant.  Xen is involved only
in that this is all happening in Xen domains.  I've got a machine with
lots of ethernets being used as a testbed for some DSL hardware.)

/~\ The ASCII                           der Mouse
\ / Ribbon Campaign
 X  Against HTML                mouse%rodents-montreal.org@localhost
/ \ Email!           7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B