ebt_ppp extension module for ebtables
Eric delalandes <[email protected]> Thu, 3 Jun 2010 08:53:19 +0000
| Newsgroups | gmane.linux.network.bridge.ebtables.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============3188136988926664534== Content-Type: multipart/alternative; boundary="_ebf0656b-bf9f-4ab2-a21c-269b18819421_" --_ebf0656b-bf9f-4ab2-a21c-269b18819421_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello to all=2C I have written an extension in order to filter pppoe and ppp frames. So ext= ension names are ebt_ppp.c and ebt_ppp.h. The goal of these extension is to= filter specific PPP discovery packet like PADO or PADS and specific PPP se= ssion packet on PPPOE protocol and PPP layer. I have used ebt_vlan.c and = ebt_vlan.h as template. See description as below: /* ebt_ppp *=20 * Authors: * Bart De Schuymer <[email protected]> * Nick Fedchik <nick-UvdXiu2sajOKBXSJ/[email protected]>=20 *=20 * June=2C 2002 */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <getopt.h> #include <ctype.h> #include "../include/ebtables_u.h" #include "../include/ethernetdb.h" #include <linux/netfilter_bridge/ebt_ppp.h> #include <linux/if_ether.h> #define NAME_PPP_CODE "code" #define NAME_PPP_LENGTH "length" #define NAME_PPP_PPPTYPE "ppptype" #define PPP_CODE '1' #define PPP_LENGTH '2' #define PPP_PPPTYPE '3' static struct option opts[] =3D { {"ppp-code" =2C required_argument=2C NULL=2C PPP_CODE}=2C {"ppp-length" =2C required_argument=2C NULL=2C PPP_LENGTH}=2C {"ppp-ppptype"=2C required_argument=2C NULL=2C PPP_PPPTYPE}=2C { 0 } }=3B /* * option inverse flags definition=20 */ #define OPT_PPP_CODE 0x01 #define OPT_PPP_LENGTH 0x02 #define OPT_PPP_PPPTYPE 0x04 #define OPT_PPP_FLAGS (OPT_PPP_CODE | OPT_PPP_LENGTH | OPT_PPP_PPPTYPE) struct ethertypeent *ethent=3B static void print_help() { printf( "ppp options:\n" "--ppp-code [!] code : pppoe code identifier=2C \n" "--ppp-length [!] length : pppoe length (integer)\n" "--ppp-ppptype [!] ppptype :PPP protocol (hexadecimal or name)\n")=3B } static void init(struct ebt_entry_match *match) { struct ebt_ppp_info *pppinfo =3D (struct ebt_ppp_info *) match->data=3B pppinfo->invflags =3D 0=3B pppinfo->bitmask =3D 0=3B } static int parse(int c=2C char **argv=2C int argc=2C const struct ebt_u_ent= ry *entry=2C unsigned int *flags=2C struct ebt_entry_match **match) { struct ebt_ppp_info *pppinfo =3D (struct ebt_ppp_info *) (*match)->data= =3B char *end=3B struct ebt_ppp_info local=3B switch (c) { case PPP_CODE: ebt_check_option2(flags=2C OPT_PPP_CODE)=3B if (ebt_check_inverse2(optarg)) pppinfo->invflags |=3D EBT_PPP_CODE=3B local.code =3D strtoul(optarg=2C &end=2C 10)=3B if (local.code >=3D 200 || *end !=3D '\0') ebt_print_error2("Invalid --code range <200 ('%s')"=2C optarg)= =3B pppinfo->code =3D local.code=3B pppinfo->bitmask |=3D EBT_PPP_CODE=3B break=3B case PPP_LENGTH: ebt_check_option2(flags=2C PPP_LENGTH)=3B if (ebt_check_inverse2(optarg)) pppinfo->invflags |=3D EBT_PPP_LENGTH=3B local.length =3D strtoul(optarg=2C &end=2C 10)=3B if (local.length > 4094 || *end !=3D '\0') ebt_print_error2("Invalid --ppp-length range ('%s')"=2C optarg)= =3B pppinfo->length =3D local.length=3B pppinfo->bitmask |=3D EBT_PPP_LENGTH=3B break=3B case PPP_PPPTYPE: ebt_check_option2(flags=2C OPT_PPP_PPPTYPE)=3B if (ebt_check_inverse2(optarg)) pppinfo->invflags |=3D EBT_PPP_PPPTYPE=3B local.ppptype =3D strtoul(optarg=2C &end=2C 16)=3B if (*end !=3D '\0') { ethent =3D getethertypebyname(optarg)=3B if (ethent =3D=3D NULL) ebt_print_error("Unknown value ('%s')"=2C optarg)=3B local.ppptype =3D ethent->e_ethertype=3B } if (local.ppptype < ETH_ZLEN) //define ETH_ZLEN 6 ebt_print_error2("Invalid ---ppptype range ('%s')"=2C optarg)= =3B pppinfo->ppptype =3D htons(local.ppptype)=3B pppinfo->bitmask |=3D EBT_PPP_PPPTYPE=3B break=3B default: return 0=3B } return 1=3B } static void final_check(const struct ebt_u_entry *entry=2C const struct ebt_entry_match *match=2C const char *name=2C unsigned int hookmask=2C unsigned int time) { if (entry->ethproto !=3D ETH_P_PPP_DISC || entry->invflags & EBT_IPROTO= ) ebt_print_error("For ppp filtering the protocol must be specified a= s PPP_DISC or PPP_SES")=3B /* Check if specified vlan-id=3D0 (priority-tagged frame condition)=20 * when vlan-prio was specified. */ /* I see no reason why a user should be prohibited to match on a perhap= s impossible situation <BDS> if (vlaninfo->bitmask & EBT_VLAN_PRIO && vlaninfo->id && vlaninfo->bitmask & EBT_VLAN_ID) ebt_print_error("When setting --vlan-prio the specified --vlan-id m= ust be 0")=3B*/ } static void print(const struct ebt_u_entry *entry=2C const struct ebt_entry_match *match) { struct ebt_ppp_info *pppinfo =3D (struct ebt_ppp_info *) match->data=3B if (pppinfo->bitmask & EBT_PPP_CODE) { printf("--ppp-code %s%d "=2C (pppinfo->invflags & EBT_PPP_CODE) ? "= ! " : ""=2C pppinfo->code)=3B } if (pppinfo->bitmask & EBT_PPP_LENGTH) { printf("--ppp-length %s%d "=2C (pppinfo->invflags & EBT_PPP_LENGTH)= ? "! " : ""=2C pppinfo->length)=3B } if (pppinfo->bitmask & EBT_PPP_PPPTYPE) { printf("--ppp-ppptype %s"=2C (pppinfo->invflags & EBT_PPP_PPPTYPE) = ? "! " : "")=3B ethent =3D getethertypebynumber(ntohs(pppinfo->ppptype))=3B if (ethent !=3D NULL) { printf("%s "=2C ethent->e_name)=3B } else { printf("%4.4X "=2C ntohs(pppinfo->ppptype))=3B } } } static int compare(const struct ebt_entry_match *ppp1=2C const struct ebt_entry_match *ppp2) { struct ebt_ppp_info *pppinfo1 =3D (struct ebt_ppp_info *) ppp1->data=3B struct ebt_ppp_info *pppinfo2 =3D (struct ebt_ppp_info *) ppp2->data=3B if (pppinfo1->bitmask !=3D pppinfo2->bitmask) return 0=3B if (pppinfo1->invflags !=3D pppinfo2->invflags) return 0=3B if (pppinfo1->bitmask & EBT_PPP_CODE && pppinfo1->code !=3D pppinfo2->code) return 0=3B if (pppinfo1->bitmask & EBT_PPP_LENGTH && pppinfo1->length !=3D pppinfo2->length) return 0=3B if (pppinfo1->bitmask & EBT_PPP_PPPTYPE && pppinfo1->ppptype !=3D pppinfo2->ppptype) return 0=3B=20 return 1=3B } static struct ebt_u_match ppp_match =3D { .name =3D "ppp"=2C .size =3D sizeof(struct ebt_ppp_info)=2C .help =3D print_help=2C .init =3D init=2C .parse =3D parse=2C .final_check =3D final_check=2C .print =3D print=2C .compare =3D compare=2C .extra_ops =3D opts=2C }=3B void _init(void) { ebt_register_match(&ppp_match)=3B } ------------------------------------------------------- #ifndef __LINUX_BRIDGE_EBT_PPP_H #define __LINUX_BRIDGE_EBT_PPP_H #define EBT_PPP_CODE 0x01 #define EBT_PPP_LENGTH 0x02 #define EBT_PPP_PPPTYPE 0x04 #define EBT_PPP_MASK (EBT_PPP_CODE| EBT_PPP_LENGTH | EBT_PPP_PPPTYPE) #define EBT_PPP_MATCH "ppp" struct ebt_ppp_info { uint8_t vertype uint8_t code=3B //PADO O7:7 //PADS 65 :101(dec) //ETH:8863 uint16_t session=3B uint16_t length=3B/ unsigned short int ppptype=3B =20 uint8_t bitmask=3B /* Args bitmask bit 1=3D1 - ID arg=2C bit 2=3D1 User-Priority arg=2C bit 3=3D1 encap*/ uint8_t invflags=3B }=3B #endif I have added to Makefile like this: EXT_FUNC+=3D802_3 nat arp arpreply ip i= p6 standard log redirect vlan mark_m mark ppp \ pkttype stp among limit ulog nflog and it compiled with no issue= . But when I launch this command line for example :=20 ./ebtables -A FORWARD -p PPP_DISC --ppp-code 7 -j DROP = // DROP PADO frames if it works A message appears: "The kernel doesn't support a certain ebtables extension=2C consider recomp= iling your kernel or insmod the extension" (see communication.c) I think it is due to the size of the structure ebt_ppp_info defined in ebt_ppp.h but I do not understand. Can anybody help me to unders= tand please? Is there other easy way to filter specific ppp packet ? Thanks=2C Eric=20 =20 _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=3D60969= --_ebf0656b-bf9f-4ab2-a21c-269b18819421_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <style><!-- .hmmessage P { margin:0px=3B padding:0px } body.hmmessage { font-size: 10pt=3B font-family:Verdana } --></style> </head> <body class=3D'hmmessage'> Hello to all=2C<br><br>I have written an extension in order to filter pppoe= and ppp frames. So extension names are ebt_ppp.c and ebt_ppp.h. The goal o= f these extension is to filter specific PPP discovery packet like PADO or P= ADS and specific PPP session packet on =3B PPPOE protocol and PPP layer= . =3B I have used ebt_vlan.c and ebt_vlan.h as template. See descriptio= n as below:<br><br>/* ebt_ppp<br> =3B* <br> =3B* Authors:<br> = =3B* Bart De Schuymer &[email protected]>=3B<br> =3B* Nick Fed= chik <=3Bnick-UvdXiu2sajOKBXSJ/[email protected]>=3B <br> =3B* <br> =3B* June=2C 20= 02<br> =3B*/<br><br>#include <=3Bstdio.h>=3B<br>#include <=3Bstdl= ib.h>=3B<br>#include <=3Bstring.h>=3B<br>#include <=3Bgetopt.h>= =3B<br>#include <=3Bctype.h>=3B<br>#include "../include/ebtables_u.h"<b= r>#include "../include/ethernetdb.h"<br>#include <=3Blinux/netfilter_brid= ge/ebt_ppp.h>=3B<br>#include <=3Blinux/if_ether.h>=3B<br><br>#define = NAME_PPP_CODE =3B =3B =3B "code"<br>#define NAME_PPP_LENGTH&nbs= p=3B "length"<br>#define NAME_PPP_PPPTYPE "ppptype"<br><br>#define PPP_CODE=  =3B =3B =3B '1'<br>#define PPP_LENGTH =3B '2'<br>#define P= PP_PPPTYPE '3'<br><br>static struct option opts[] =3D {<br> =3B =3B=  =3B {"ppp-code" =3B =3B =2C required_argument=2C NULL=2C PPP_C= ODE}=2C<br> =3B =3B =3B {"ppp-length" =2C required_argument=2C = NULL=2C PPP_LENGTH}=2C<br> =3B =3B =3B {"ppp-ppptype"=2C requir= ed_argument=2C NULL=2C PPP_PPPTYPE}=2C<br> =3B =3B =3B { 0 }<br= >}=3B<br><br>/*<br> =3B* option inverse flags definition <br> =3B*/= <br>#define OPT_PPP_CODE =3B =3B =3B =3B 0x01<br>#define OP= T_PPP_LENGTH =3B =3B 0x02<br>#define OPT_PPP_PPPTYPE =3B 0x04<b= r>#define OPT_PPP_FLAGS =3B =3B =3B (OPT_PPP_CODE | OPT_PPP_LEN= GTH | OPT_PPP_PPPTYPE)<br><br>struct ethertypeent *ethent=3B<br><br>static = void print_help()<br>{<br> =3B =3B =3B printf(<br>"ppp options:= \n"<br>"--ppp-code [!] code =3B =3B =3B =3B =3B =3B= : pppoe code identifier=2C \n"<br>"--ppp-length [!] length =3B =3B= : pppoe length (integer)\n"<br>"--ppp-ppptype [!] ppptype :PPP protocol (h= exadecimal or name)\n")=3B<br>}<br><br>static void init(struct ebt_entry_ma= tch *match)<br>{<br> =3B =3B =3B struct ebt_ppp_info *pppinfo = =3D (struct ebt_ppp_info *) match->=3Bdata=3B<br> =3B =3B =3B= pppinfo->=3Binvflags =3D 0=3B<br> =3B =3B =3B pppinfo->=3B= bitmask =3D 0=3B<br>}<br><br><br>static int parse(int c=2C char **argv=2C i= nt argc=2C const struct ebt_u_entry *entry=2C<br> =3B =3B unsigned = int *flags=2C struct ebt_entry_match **match)<br>{<br> =3B =3B = =3B struct ebt_ppp_info *pppinfo =3D (struct ebt_ppp_info *) (*match)->= =3Bdata=3B<br> =3B =3B =3B char *end=3B<br> =3B =3B&nbs= p=3B struct ebt_ppp_info local=3B<br><br> =3B =3B =3B switch (c= ) {<br> =3B =3B =3B case PPP_CODE:<br> =3B =3B =3B =  =3B =3B =3B ebt_check_option2(flags=2C OPT_PPP_CODE)=3B<br>&nb= sp=3B =3B =3B  =3B =3B =3B if (ebt_check_inverse2(optar= g))<br> =3B =3B =3B  =3B =3B =3B  =3B =3B&n= bsp=3B pppinfo->=3Binvflags |=3D EBT_PPP_CODE=3B<br> =3B =3B = =3B  =3B =3B =3B local.code =3D strtoul(optarg=2C &=3Bend=2C= 10)=3B<br> =3B =3B =3B  =3B =3B =3B if (local.code= >=3B=3D 200 || *end !=3D '\0')<br> =3B =3B =3B  =3B = =3B =3B  =3B =3B =3B ebt_print_error2("Invalid --code range= <=3B200 ('%s')"=2C optarg)=3B<br> =3B =3B =3B  =3B = =3B =3B pppinfo->=3Bcode =3D local.code=3B<br> =3B =3B = =3B  =3B =3B =3B pppinfo->=3Bbitmask |=3D EBT_PPP_CODE=3B<br>=  =3B =3B =3B  =3B =3B =3B break=3B<br><br> =3B&= nbsp=3B =3B case PPP_LENGTH:<br><br> =3B =3B =3B  =3B&n= bsp=3B =3B ebt_check_option2(flags=2C PPP_LENGTH)=3B<br> =3B = =3B =3B  =3B =3B =3B if (ebt_check_inverse2(optarg))<br>&nb= sp=3B =3B =3B  =3B =3B =3B  =3B =3B =3B ppp= info->=3Binvflags |=3D EBT_PPP_LENGTH=3B<br> =3B =3B =3B &nbs= p=3B =3B =3B local.length =3D strtoul(optarg=2C &=3Bend=2C 10)= =3B<br> =3B =3B =3B  =3B =3B =3B if (local.length &= gt=3B 4094 || *end !=3D '\0')<br> =3B =3B =3B  =3B =3B&= nbsp=3B  =3B =3B =3B ebt_print_error2("Invalid --ppp-length ran= ge ('%s')"=2C optarg)=3B<br> =3B =3B =3B  =3B =3B = =3B pppinfo->=3Blength =3D local.length=3B<br> =3B =3B =3B &n= bsp=3B =3B =3B pppinfo->=3Bbitmask |=3D EBT_PPP_LENGTH=3B<br>&nbs= p=3B =3B =3B  =3B =3B =3B break=3B<br> =3B =3B&= nbsp=3B case PPP_PPPTYPE:<br> =3B =3B =3B  =3B =3B = =3B ebt_check_option2(flags=2C OPT_PPP_PPPTYPE)=3B<br> =3B =3B = =3B  =3B =3B =3B if (ebt_check_inverse2(optarg))<br> =3B&nb= sp=3B =3B  =3B =3B =3B  =3B =3B =3B pppinfo->= =3Binvflags |=3D EBT_PPP_PPPTYPE=3B<br> =3B =3B =3B  =3B&nb= sp=3B =3B local.ppptype =3D strtoul(optarg=2C &=3Bend=2C 16)=3B<br>&= nbsp=3B =3B =3B  =3B =3B =3B if (*end !=3D '\0') {<br>&= nbsp=3B =3B =3B  =3B =3B =3B  =3B =3B =3B e= thent =3D getethertypebyname(optarg)=3B<br> =3B =3B =3B  = =3B =3B =3B  =3B =3B =3B if (ethent =3D=3D NULL)<br>&nb= sp=3B =3B =3B  =3B =3B =3B  =3B =3B =3B &nb= sp=3B =3B =3B ebt_print_error("Unknown =3B value ('%s')"=2C opt= arg)=3B<br> =3B =3B =3B  =3B =3B =3B  =3B = =3B =3B local.ppptype =3D ethent->=3Be_ethertype=3B<br> =3B = =3B =3B  =3B =3B =3B }<br> =3B =3B =3B  =3B=  =3B =3B if (local.ppptype <=3B ETH_ZLEN) //define ETH_ZLEN = =3B =3B =3B 6<br> =3B =3B =3B  =3B =3B =3B =  =3B =3B =3B ebt_print_error2("Invalid ---ppptype range ('%s')"= =2C optarg)=3B<br> =3B =3B =3B  =3B =3B =3B pppinfo= ->=3Bppptype =3D htons(local.ppptype)=3B<br> =3B =3B =3B &nbs= p=3B =3B =3B pppinfo->=3Bbitmask |=3D EBT_PPP_PPPTYPE=3B<br> = =3B =3B =3B  =3B =3B =3B break=3B<br> =3B =3B&n= bsp=3B default:<br> =3B =3B =3B  =3B =3B =3B return= 0=3B<br><br> =3B =3B =3B }<br> =3B =3B =3B return = 1=3B<br>}<br><br>static void final_check(const struct ebt_u_entry *entry=2C= <br> =3B =3B const struct ebt_entry_match *match=2C<br> =3B&nbs= p=3B const char *name=2C unsigned int hookmask=2C unsigned int time)<br>{<b= r> =3B =3B =3B if (entry->=3Bethproto !=3D ETH_P_PPP_DISC || = entry->=3Binvflags &=3B EBT_IPROTO)<br> =3B =3B =3B  = =3B =3B =3B ebt_print_error("For ppp filtering the protocol must be= specified as PPP_DISC or PPP_SES")=3B<br><br> =3B =3B =3B /* C= heck if specified vlan-id=3D0 (priority-tagged frame condition) <br> = =3B =3B =3B  =3B* when vlan-prio was specified. */<br> =3B&= nbsp=3B =3B /* I see no reason why a user should be prohibited to match= on a perhaps impossible situation <=3BBDS>=3B<br> =3B =3B = =3B if (vlaninfo->=3Bbitmask &=3B EBT_VLAN_PRIO &=3B&=3B<br>&nbs= p=3B =3B =3B  =3B =3B =3B vlaninfo->=3Bid &=3B&= =3B vlaninfo->=3Bbitmask &=3B EBT_VLAN_ID)<br> =3B =3B =3B=  =3B =3B =3B ebt_print_error("When setting --vlan-prio the spe= cified --vlan-id must be 0")=3B*/<br>}<br><br>static void print(const struc= t ebt_u_entry *entry=2C<br> =3B =3B const struct ebt_entry_match *m= atch)<br>{<br> =3B =3B =3B struct ebt_ppp_info *pppinfo =3D (st= ruct ebt_ppp_info *) match->=3Bdata=3B<br><br> =3B =3B =3B if= (pppinfo->=3Bbitmask &=3B EBT_PPP_CODE) {<br> =3B =3B =3B=  =3B =3B =3B printf("--ppp-code %s%d "=2C (pppinfo->=3Binvfl= ags &=3B EBT_PPP_CODE) ? "! " : ""=2C pppinfo->=3Bcode)=3B<br> =3B=  =3B =3B }<br> =3B =3B =3B if (pppinfo->=3Bbitmask &a= mp=3B EBT_PPP_LENGTH) {<br> =3B =3B =3B  =3B =3B = =3B printf("--ppp-length %s%d "=2C (pppinfo->=3Binvflags &=3B EBT_PPP_= LENGTH) ? "! " : ""=2C pppinfo->=3Blength)=3B<br> =3B =3B =3B= }<br> =3B =3B =3B if (pppinfo->=3Bbitmask &=3B EBT_PPP_PP= PTYPE) {<br> =3B =3B =3B  =3B =3B =3B printf("--ppp= -ppptype %s"=2C (pppinfo->=3Binvflags &=3B EBT_PPP_PPPTYPE) ? "! " : "= ")=3B<br> =3B =3B =3B  =3B =3B =3B ethent =3D getet= hertypebynumber(ntohs(pppinfo->=3Bppptype))=3B<br> =3B =3B = =3B  =3B =3B =3B if (ethent !=3D NULL) {<br> =3B =3B&nb= sp=3B  =3B =3B =3B  =3B =3B =3B printf("%s "=2C eth= ent->=3Be_name)=3B<br> =3B =3B =3B  =3B =3B =3B }= else {<br> =3B =3B =3B  =3B =3B =3B  =3B = =3B =3B printf("%4.4X "=2C ntohs(pppinfo->=3Bppptype))=3B<br> =3B=  =3B =3B  =3B =3B =3B }<br> =3B =3B =3B }<b= r>}<br><br>static int compare(const struct ebt_entry_match *ppp1=2C<br>&nbs= p=3B =3B const struct ebt_entry_match *ppp2)<br>{<br> =3B =3B&n= bsp=3B struct ebt_ppp_info *pppinfo1 =3D (struct ebt_ppp_info *) ppp1->= =3Bdata=3B<br> =3B =3B =3B struct ebt_ppp_info *pppinfo2 =3D (s= truct ebt_ppp_info *) ppp2->=3Bdata=3B<br><br> =3B =3B =3B if= (pppinfo1->=3Bbitmask !=3D pppinfo2->=3Bbitmask)<br> =3B =3B&n= bsp=3B  =3B =3B =3B return 0=3B<br> =3B =3B =3B if = (pppinfo1->=3Binvflags !=3D pppinfo2->=3Binvflags)<br> =3B =3B&= nbsp=3B  =3B =3B =3B return 0=3B<br> =3B =3B =3B if= (pppinfo1->=3Bbitmask &=3B EBT_PPP_CODE &=3B&=3B<br> =3B&nb= sp=3B =3B  =3B =3B =3B pppinfo1->=3Bcode !=3D pppinfo2-&g= t=3Bcode)<br> =3B =3B =3B  =3B =3B =3B return 0=3B<= br> =3B =3B =3B if (pppinfo1->=3Bbitmask &=3B EBT_PPP_LENG= TH &=3B&=3B<br> =3B =3B =3B  =3B =3B =3B pppi= nfo1->=3Blength !=3D pppinfo2->=3Blength)<br> =3B =3B =3B &= nbsp=3B =3B =3B return 0=3B<br> =3B =3B =3B if (pppinfo= 1->=3Bbitmask &=3B EBT_PPP_PPPTYPE &=3B&=3B<br> =3B =3B&= nbsp=3B  =3B =3B =3B pppinfo1->=3Bppptype !=3D pppinfo2->= =3Bppptype)<br> =3B =3B =3B  =3B =3B =3B return 0= =3B <br> =3B =3B =3B return 1=3B<br>}<br><br>static struct ebt_= u_match ppp_match =3D {<br> =3B =3B =3B .name =3B =3B&n= bsp=3B  =3B =3B =3B =3D "ppp"=2C<br> =3B =3B =3B .s= ize =3B =3B =3B  =3B =3B =3B =3D sizeof(struct ebt_= ppp_info)=2C<br> =3B =3B =3B .help =3B =3B =3B &nbs= p=3B =3B =3B =3D print_help=2C<br> =3B =3B =3B .init&nb= sp=3B =3B =3B  =3B =3B =3B =3D init=2C<br> =3B = =3B =3B .parse =3B =3B =3B  =3B =3B =3B =3D par= se=2C<br> =3B =3B =3B .final_check =3B =3B =3B =3D = final_check=2C<br> =3B =3B =3B .print =3B =3B =3B &= nbsp=3B =3B =3B =3D print=2C<br> =3B =3B =3B .compare&n= bsp=3B =3B =3B =3D compare=2C<br> =3B =3B =3B .extra_op= s =3B =3B =3B =3D opts=2C<br>}=3B<br><br>void _init(void)<br>{<= br> =3B =3B =3B ebt_register_match(&=3Bppp_match)=3B<br>}<br= ><br><br>-------------------------------------------------------<br>#ifndef= __LINUX_BRIDGE_EBT_PPP_H<br>#define __LINUX_BRIDGE_EBT_PPP_H<br><br>#defin= e EBT_PPP_CODE =3B =3B =3B 0x01<br>#define EBT_PPP_LENGTH = =3B =3B =3B 0x02<br>#define EBT_PPP_PPPTYPE =3B =3B =3B= 0x04<br>#define EBT_PPP_MASK (EBT_PPP_CODE| EBT_PPP_LENGTH | EBT_PPP_PPPTY= PE)<br>#define EBT_PPP_MATCH "ppp"<br><br><br>struct ebt_ppp_info <br>{ <br> =3B uint8_t vertype<br> =3B uint8_t code=3B //PADO O7:7 = =3B //PADS 65 :101(dec) //ETH:8863 <br> =3B uint16_t session=3B <br> =3B uint16_t length=3B/<br> =3B unsigned short int ppptype=3B&= nbsp=3B <br><br> =3B uint8_t bitmask=3B =3B =3B =3B  = =3B =3B =3B /* Args bitmask bit 1=3D1 - ID arg=2C<br> =3B = =3B =3B  =3B =3B =3B  =3B =3B =3B  =3B = =3B bit 2=3D1 User-Priority arg=2C bit 3=3D1 encap*/<br> =3B uint8_t in= vflags=3B <br>}=3B<br>#endif<br><br><br><br>I have added to Makefile like this: EXT_F= UNC+=3D802_3 nat arp arpreply ip ip6 standard log redirect vlan mark_m mark= <font style=3D"" color=3D"#e36c09"> ppp</font> \<br> =3B =3B = =3B =3B =3B =3B =3B =3B =3B pkttype stp among limit= ulog nflog =3B and it compiled with no issue.<br><br> =3BBut when = I launch this command line for example : <br>./ebtables -A FORWARD -p PPP_D= ISC --ppp-code 7 -j DROP  =3B  =3B  =3B  =3B  =3B  = =3B  =3B  =3B  =3B  =3B =3B // DROP PADO frames if it w= orks<br><br>A message appears:<br>"The kernel doesn't support a certain ebt= ables extension=2C consider recompiling your kernel or insmod the extension= "<br>(see communication.c)<br><br><br>I think it is due to the size of the = structure ebt_ppp_info defined in ebt_ppp.h but I do not understand. Can anybody help me to unders= tand please?<br><br>Is there other easy way to filter specific ppp packet ?= <br><br>Thanks=2C<br><br>Eric <br><br><br><br><br><br><br><br><br><br><br> = <br /><hr />Your E-mail and More On-the-Go. Get Windows Live Hot= mail Free. <a href=3D'https://signup.live.com/signup.aspx?id=3D60969' targe= t=3D'_new'>Sign up now.</a></body> </html>= --_ebf0656b-bf9f-4ab2-a21c-269b18819421_-- --===============3188136988926664534== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win: http://p.sf.net/sfu/thinkgeek-promo --===============3188136988926664534== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ebtables-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ebtables-devel --===============3188136988926664534==--