ebtables and 64-bit OpenVZ Linux kernel

CentOS 5.4 doesn't have its own ebtables package, so we use the ebtables package found in the EPEL repository. Unfortunately, when you install the x86_64 OpenVZ kernel onto your 64-bit CentOS 5.4, this ebtables (ebtables-2.0.8-1.el5.x86_64) package doesn't work:

# ebtables -N test -P DROP
The kernel doesn't support a certain ebtables extension, consider 
recompiling your kernel or insmod the extension.
#

And the kernel gives us this message:

# dmesg | tail
Ebtables v2.0 registered
kernel msg: ebtables bug: please report to author: entries_size too small

If you download the latest ebtables source (ebtables-v2.0.9.tar.gz) and do a make && make install you experience the same problem. When you build with make static things appear to work somewhat, but some commands still fail.

The solution is to fall back to the year 2003 and get ebtables-v2.0.6.tar.gz. You'll need the three patches found here: 2.6.20.patch, gcc4.patch, and iets.patch.

Here is how to make it work:

> tar xzf ebtables-v2.0.6.tar.gz
> cd ebtables-v2.0.6.tar.gz
> patch -p1 < ~/2.6.20.patch
patching file include/linux/netfilter_bridge.h
> patch -p1 < ~/gcc4.patch
patching file extensions/ebt_ip.c
patching file extensions/ebt_limit.c
patching file extensions/ebt_vlan.c
> patch -p1 < ~/iets.patch
patching file ebtables.c
> make
> sudo make install

Now you'll have a working ebtables, but with 2003 syntax. This means some commands won't work, such as:
ebtables -N test -P DROP
now must be written as:
ebtables -N test; ebtables -P test DROP
or
ebtables -I FORWARD -j ACCEPT
now requires a rule number:
ebtables -I FORWARD 1 -j ACCEPT

Maybe there is a better solution out there?