`among' match

Ehlo!

I have recently created a new match for ebtables to fulfill my needs. It
checks if the dst or src MAC address of a packet is one of the specified
in a list.

For example, you can write:

ebtables -A FORWARD --among-src 00:AE:00:00:00:67,00:01:02:F3:FA:52,00:00:DE:AD:BE:EF -j ACCEPT

instead of writing

ebtables -A FORWARD -s 00:AE:00:00:00:67 -j ACCEPT
ebtables -A FORWARD -s 00:01:02:F3:FA:52 -j ACCEPT
ebtables -A FORWARD -s 00:00:DE:AD:BE:EF -j ACCEPT

and it works faster since packets go through one rule than N rules.

You can specify up to 256 addresses in a list and therefore avoid writing
256 separate rules for each MAC address (and avoid passing the packets
through 256 rules, which would overload CPU). This is useful for creating
bridges with "mac-security" feature, and for many other applications.

Maybe you will not like the way I implemented this. There is a large,
4102-byte target info structure (unlike standard info structures, which
are <100 bytes long). Also, I have used some tricks to gain max
efficiency.

I haven't created a patch for existing software. Instead, I include an
archive, containing 4 files to be added into software tree. They are
organized roughly as they are in CVS tree. Namely:

tar ztf among.tar.gz

userspace/ebtables2/extensions/ebt_among.c
userspace/ebtables2/include/linux/netfilter_bridge/ebt_among.h
kernel/linux/net/bridge/netfilter/ebt_among.c
kernel/linux/include/linux/netfilter_bridge/ebt_among.h

You should also modify Makefile's and Config.in files manually, since if I
created a patch for them, it would probably fail and you would have to
modify them manually anyway (since you probably have different Makefile's
and Config.in's than I have).

It worked with 2.4.21, I haven't tried with 2.5.x nor with 2.6.x.

Greetings,
-- 
Grzesław