Re: IP over PPPoe:PPP extraction

>----- Oorspronkelijk bericht -----
>Van: Marek Jawurek [mailto:[email protected]]
>Verzonden: maandag, juni 19, 2006 11:52 PM
>Aan: [email protected]
>Onderwerp: [Ebtables-devel] IP over PPPoe:PPP extraction
>
>Hi there,
>
>I found a post of this mailinglist here:
>http://article.gmane.org/gmane.linux.network.bridge.ebtables.devel/413/match=ppp
>
>It appears that this patch has never made it into the code. I am very
>interested in this functionality and would be willing to code if
>provided with some ideas/hints. (I am know kernel insider -- yet ;-) but
>I think using the tutorial online it can't be so difficult).
>
>First, here is what I need: A way to extract and redirect certain IP
>packets (depending on the IP header) from an Ethernet:PPPoe:PPP: stream.
>
>>From Barts answer I deduct that a general solution would be better than
>to add this PPPoE/PPP extraction to every embeddeble protocol and every
>embedding protocol. I had a look through the tutorial and the sourcecode
>but from what I gathered the functionalities of different filters are
>not easily combinable ? If I understand the approach that Thomas
>ESTASECCA wanted to patch-in: apply the PPPoe:PPP extraction first and
>then test for the usual IP header/fields against the rule spec. 

That's not really what I meant. It's just that the same functionality can be obtained without having to add new flags to ebtables' kernel space ip match struct.
This is how:
The ebt_filter_ip() function doesn't check the MAC protocol type because that's  done elsewhere. This allows us to add the functionality without having to use new flags (in kernel space).

What we could do is add the userspace --embedded-proto flag.
Valid rules:
ebtables -p IPv4 --ip-proto x -j ACCEPT
ebtables -p PPoE --embedded-proto --ip-proto x -j ACCEPT
invalid rule (providing backwards compatibility):
ebtables -p PPoE --ip-proto x -j ACCEPT

This can then be translated to kernel space, without having a new flag (the --embedded-proto flag is only necessary in userspace).
Of course, ebtables' kernel ip match function will need to be altered in a similar way as Estasecca did.
If the rule
ebtables -p PPoE --embedded-proto --ip-proto x -j ACCEPT
is given to a kernel that doesn't have this functionality, the kernel (i.e. the check function of the ebtables ip match module) will not accept it, so there's no danger there either.

cheers,
Bart