Bugs in ebtables-restore extension presence checks and other, suggestion for /proc interface

Hi. I'm working on ebtables init script for Gentoo, and I've encountered

certain problems when trying to control it with ebtables-save and

ebtables-restore. I'm against using kernel modules on servers, routers
and bridges, and therefore I've compiled complete ebtables inside the
kernel. As ebtables-save was querying /proc/modules to get installed
ebtables extensions, I've patched it to fallback to manual configuration
when nothing is detected, and it works. But when I try to restore the
rules and policies, ebtables-restore comes up with strange errors. For
example, although broute table is enabled, when I try to tell
ebtables-restore that this table is to be configured, it comes up with
this message: "The kernel doesn't support a certain ebtables extension,
consider recompiling your kernel or insmod the extension.". Sometimes I
get same message not for broute, but for nat table. It was never
encountered for filter table, like in here:

router ~ # ebtables-restore
*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT

*nat
:PREROUTING ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT

*broute
The kernel doesn't support a certain ebtables extension, consider
recompiling your kernel or insmod the extension.


The next error, is when I try to restore particular rule (this one is
connected with MAC SNAT - very common use) i get the following:

router ~ # ebtables-restore
*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
*nat
:PREROUTING ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
-A POSTROUTING -o wlan0 -j snat --to-src 0:50:fc:48:fb:9b --snat-target
ACCEPT
Ebtables: libebtc.c ebt_check_for_loops 1007 :Out of memory.

When setting this rule manually the bridge behaves as it should and the
rule produces it's effect. But when I try to restore it it isn't
written. I haven't any idea for more test cases, but after reading
ebtables-restore.c I'm sure that these errors don't originate from
ebtables-restore itself, moreover, the second error states libebtc.c. As
I think many people don't like using any modules on bridges/routers or
servers I came up with idea of creating /proc interface showing at least
supported table names to get rid of manual configuration and/or grepping
/proc/modules in either Gentoo and script supplied with your package,
just like in iptables. Bart, What do you think about it?





-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/