# ppp active-filter libpcap >0.7.2-r1

## AxelG

Hi folks,

I am using active-filter in my /etc/ppp/options even I do have a flat rate because I consider a hang-down as a security-issue

The point is that current libpcap don't support it anymore. Hence my /etc/package.mask looks like:

>net-libs/libpcap-0.7.2-r1  #last version supporting active-filter

and my package.use 

net-dialup/ppp activefilter ssl sasl sasl2

But now current ppp like ppp-2.4.2-r9 requires libpcap-0.8.3-r1in that respect and my above solution ends up in a:

------------------------------------8<-----------------------------------

Calculating dependencies -

!!! All ebuilds that could satisfy ">=net-libs/libpcap-0.8.3-r1" have been masked.

!!! One of the following masked packages is required to complete your request:

- net-libs/libpcap-0.8.3-r1 (masked by: package.mask)

For more information, see MASKED PACKAGES section in the emerge man page or

section 2.2 "Software Availability" in the Gentoo Handbook.

!!!    (dependency required by "net-dialup/ppp-2.4.2-r9" [ebuild])

------------------------------------8<-----------------------------------

What I do instead of forcing to ignore dependencies I allow libpcap--0.8.3-r1 to compile (set package.mask commented) and later I recompile the older version.

This is like a crutch like we say and awful.

Is there any other possibility?!?

TNX in advance for any help...

Axel

----------

## mrness

>=net-libs/libpcap-0.8.3-r1 is a dependency of ppp _because_ is needed by active filter feature.

please let ppp ebuild choose its dependencies.

----------

## AxelG

 *mrness wrote:*   

> >=net-libs/libpcap-0.8.3-r1 is a dependency of ppp _because_ is needed by active filter feature.
> 
> please let ppp ebuild choose its dependencies.

 

Pls see my text!

libpcap does not support active-filter anymore. At least this is my experiance!

As I explained rather detailed, I let ppp ebuild choose everything and active-filter is not working. THAN I Downgrade to the 0.7.2-r1 and suddenly it works! I am tired to make this game all the time and looking for a solution. THAT was my question.

Axek

----------

## mrness

the following quote is from http://www.samba.org/ppp/README.html, regarding ppp-2.4.3 and llibpcap-0.8.3:

 *Quote:*   

> * The code has been updated to work with version 0.8.3 of libpcap.
> 
>   Unfortunately the libpcap maintainers removed support for the
> 
>   "inbound" and "outbound" keywords on PPP links, meaning that if you
> ...

 

if current stable version of ppp does not work with libpcap-0.8.3,

maybe you should try add "net-dialup/ppp ~x86" in /etc/portage/package.keywords.

----------

## StefanP

Even with a current snapshot of libpcap the active-filter option is not working.

There is a bug in the ebuild for ppp-2.4.3. It sed'd some include-files formerly 

came with libpcap-0.7.2. Because of the dependency to libpcap-0.8.3, the active-filter option is not compiled any more into ppp.  

After I got ppp accept the option active-filter,  the libpcap complained something like 'outbound not valid for linktype 9'. So the ppp guys still have some work to do,. I have posted this information to the buglist of ppp, hopes this will help. See also my ozter post in this forum.

Stefan

----------

## mrness

Stefan, have you read what I've posted above? It says, pretty clear I may add, that "inbound" and "outbound" keywords are not supported by libpcap-0.8.3 but will be supported by 0.8.4

All you have to do is remove these keywords from your filter for the time being.

----------

## StefanP

1. What about the bug in ppp-2.4.3.ebuild?

 *Quote:*   

> If you need the in/outbound keywords, use a later release
> 
> than 0.8.3, or get the CVS version from

 

2.  Even with the current libpcap (snapshot taken yesterday) ppp complains about a wrong linktype. This message normally is generated from the library. For me it means, that the implementation of ppp is wrong.

3. The keyword is not the problem, the problem is the function you want to have with it. Deleting the keyword 'outbound' will not lead to hang up the dsl-connection.

----------

## StefanP

This is what I got from Karsten Keil, a member of SuSE Labs:

I haven' tested this patch yet with ppp-2.4.3, but I will as soon as possible.

From Karsten Keil, see tcpdump-workers@lists.tcpdump.org:

Yes direction support was removed from DLT_PPP in newer versions, I run

in the same problem some time ago.

I was told, that the reason for the remove was, that this was incorrect,

since PPP it self has no direction flag, the PPP filter added a fake

bit in the protocol header to handle this.

But here is a new DLT_PPP_WITHDIRECTION which handle this like the

old libpcap. All you have to do is, to change pppd filter code to

use DLT_PPP_WITHDIRECETION instead of DLT_PPP.

DLT_PPP_WITHDIRECTION is at least availbe from libpcap CVS version,

I do not check, if here is a new offficial version available with it.

Here is my pppd patch:

diff -ur ppp-2.4.2.org/pppd/demand.c ppp-2.4.2/pppd/demand.c

--- ppp-2.4.2.org/pppd/demand.c		 2004-08-25 00:48:45.280320718 +0200

+++ ppp-2.4.2/pppd/demand.c		 2004-08-25 00:36:48.441279079 +0200

@@ -50,8 +50,9 @@

 #include <sys/socket.h>

 #ifdef PPP_FILTER

 #include <net/if.h>

-#include <net/bpf.h>

+#include <pcap-bpf.h>

 #include <pcap.h>

+#include <linux/if_ether.h>

 #endif

 #include "pppd.h"

diff -ur ppp-2.4.2.org/pppd/options.c ppp-2.4.2/pppd/options.c

--- ppp-2.4.2.org/pppd/options.c		 2004-08-25 00:49:30.960260765 +0200

+++ ppp-2.4.2/pppd/options.c		 2004-08-25 01:22:21.523384931 +0200

@@ -56,7 +56,6 @@

 #endif

 #ifdef PPP_FILTER

 #include <pcap.h>

-#include <pcap-int.h>		 /* XXX: To get struct pcap */

 #endif

 #include "pppd.h"

@@ -122,7 +121,6 @@

 #ifdef PPP_FILTER

 struct		 bpf_program pass_filter;/* Filter program for packets to pass */

 struct		 bpf_program active_filter; /* Filter program for link-active pkts */

-pcap_t  pc;		 		 		 /* Fake struct pcap so we can compile expr */

 #endif

 char *current_option;		 		 /* the name of the option being parsed */

@@ -1439,12 +1437,24 @@

 setpassfilter(argv)

     char **argv;

 {

-    pc.linktype = DLT_PPP;

-    pc.snapshot = PPP_HDRLEN;

- 

-    if (pcap_compile(&pc, &pass_filter, *argv, 1, netmask) == 0)

+#ifdef DLT_PPP_WITHDIRECTION

+    pcap_t* pc = pcap_open_dead (DLT_PPP_WITHDIRECTION, PPP_HDRLEN);

+#else

+    #warning with libpcap 0.8... you are not able to use IN/OUT filters with DLT_PPP

+    pcap_t* pc = pcap_open_dead (DLT_PPP, PPP_HDRLEN);

+#endif

+    if (!pc) {

+		 option_error("error in pass-filter expression: pcap_open_dead failed\n");

+		 return 0;

+    }

+

+    if (pcap_compile(pc, &pass_filter, *argv, 1, netmask) == 0) {

+		 pcap_close (pc);

 		 return 1;

-    option_error("error in pass-filter expression: %s\n", pcap_geterr(&pc));

+    }

+

+    option_error("error in pass-filter expression: %s\n", pcap_geterr(pc));

+    pcap_close (pc);

     return 0;

 }

@@ -1455,12 +1465,25 @@

 setactivefilter(argv)

     char **argv;

 {

-    pc.linktype = DLT_PPP;

-    pc.snapshot = PPP_HDRLEN;

- 

-    if (pcap_compile(&pc, &active_filter, *argv, 1, netmask) == 0)

+#ifdef DLT_PPP_WITHDIRECTION

+    pcap_t* pc = pcap_open_dead (DLT_PPP_WITHDIRECTION, PPP_HDRLEN);

+#else

+#warning with libpcap 0.8... you are not able to use IN/OUT filters with DLT_PPP

+    pcap_t* pc = pcap_open_dead (DLT_PPP, PPP_HDRLEN);

+#endif

+

+    if (!pc) {

+		 option_error("error in active-filter expression: pcap_open_dead failed\n");

+		 return 0;

+    }

+

+    if (pcap_compile(pc, &active_filter, *argv, 1, netmask) == 0) {

+		 pcap_close (pc);

 		 return 1;

-    option_error("error in active-filter expression: %s\n", pcap_geterr(&pc));

+    }

+

+    option_error("error in active-filter expression: %s\n", pcap_geterr(pc));

+    pcap_close (pc);

     return 0;

 }

 #endif

diff -ur ppp-2.4.2.org/pppd/sys-linux.c ppp-2.4.2/pppd/sys-linux.c

--- ppp-2.4.2.org/pppd/sys-linux.c		 2004-08-25 00:49:30.976258643 +0200

+++ ppp-2.4.2/pppd/sys-linux.c		 2004-08-25 00:51:26.735901663 +0200

@@ -141,7 +141,7 @@

 #endif /* IPX_CHANGE */

 #ifdef PPP_FILTER

-#include <net/bpf.h>

+#include <pcap-bpf.h>

 #include <linux/filter.h>

 #endif /* PPP_FILTER */

diff -ur ppp-2.4.2.org/pppd/demand.c ppp-2.4.2/pppd/demand.c

--- ppp-2.4.2.org/pppd/demand.c		 2004-09-21 15:12:36.419304045 +0200

+++ ppp-2.4.2/pppd/demand.c		 2004-09-21 15:12:36.419304045 +0200

@@ -349,12 +349,14 @@

 		 return 0;

     proto = PPP_PROTOCOL(p);

 #ifdef PPP_FILTER

+    *p = 1; /* set outbound for the filter rule */

     if (pass_filter.bf_len != 0

 		 && bpf_filter(pass_filter.bf_insns, p, len, len) == 0)

 		 return 0;

     if (active_filter.bf_len != 0

 		 && bpf_filter(active_filter.bf_insns, p, len, len) == 0)

 		 return 0;

+    *p = 0xff; /* restore original ppp header */

 #endif

     for (i = 0; (protp = protocols[i]) != NULL; ++i) {

 		 if (protp->protocol < 0xC000 && (protp->protocol & ~0x8000) == proto) {

[/b]

----------

## mrness

this is not the proper place to file a bug.

that's bugs.gentoo.org's job.

----------

## AxelG

Hi all,

I am still missing the inbound/outbound active-filter for ppp. It is understood that libpcap 0.8.4 might support it again. However I am not willing to dismiss this funtion for the time beeing.

In the meanwhile I added >libpcap-0.7.2-r1 in my /etc/portage/package.mask

Every now and than I had to quote that in order to run emerge -auD world and than reemerge the old libpcap. What happened now? The libpcap-0.7.2-r1.ebuild has been removed out of the portage-tree.... CONGRATULATIONS  :Evil or Very Mad:   :Mad: 

Does anyone have a hint for me since I absolutely want to use the hang-down funktion!

Regards

 Axel

----------

## mrness

If you have libpcap-0.7.2-r1 installed, you'll find libpcap-0.7.2-r1.ebuild file in /var/db/pkg dir, even if it gets removed from the main tree.

To use that, all you have to do is setting PORTDIR_OVERLAY to your custom part of the tree (e.g. /usr/local/portage) which should contain this ebuild.

----------

## AxelG

Hi mrness

 *mrness wrote:*   

> If you have libpcap-0.7.2-r1 installed, you'll find libpcap-0.7.2-r1.ebuild file in /var/db/pkg dir, even if it gets removed from the main tree.
> 
> To use that, all you have to do is setting PORTDIR_OVERLAY to your custom part of the tree (e.g. /usr/local/portage) which should contain this ebuild.

 

That's what I am supposed to do. TNX for that tip with /var/db/pkg since I didn't know or realize  :Wink: 

On tcpdump.org it was mentioned that "direction filter" is the right way to substitute in-/outbound. The point is that in that respect I am a script-kid (even beein' 36 ;>> )  and donno what to do to substitute the following:

----------

## Thomas Welsch

I've got the same problems with ppp active_filter and libpcap.

I have tryed different combinations and several  recognises the

"outbound" keyword in active_filter. (after some hacks, see above...  :Smile:  )

1.) new ppp + libpcap from cvs: No dialout for pings

2.) new/old ppp + libpcap 0.7.2: Allways "Terminating connection due to lack of activity" with demand-dialing

An older libcap and ppp 2.4.0 works for years on my old firewall...

Does anybody has a running configuration ?!

So: Any tips (ppp,libpcap,kernel versions and active_filter entry)  :Question: 

Thanks in advance,

  Thomas

PS: I'm using rp-pppoe for DSL connects. Should i bette use pppoed ?

----------

