Hello, I was working on ulogd2 and getting mad with connection filtering in IPv6 (IPv4 being ok). After analysis, it seems there is a problem. I've modified the conntrack_filter in utils by applying the following patch. It does nothing but inverting the logic of filtering and adding filtering to destination. If I do : $ telnet 2::1 then root@tiger:/home/eric/git/netfilter/libnetfilter_conntrack/utils# ./conntrack_filter TEST: waiting for 10 events... [UPDATE] tcp 6 432000 ESTABLISHED src=2::1 dst=2::1 sport=35738 dport=22 src=2::1 dst=2::1 sport=22 dport=35738 [ASSURED] Am I missing something ? Kernel is a 3.4.0: Linux tiger 3.4.0-netfilter #22 SMP Sat Jul 14 21:39:33 CEST 2012 x86_64 GNU/Linux BR, -- Eric Leblond Blog: http://home.regit.org/ - Portfolio: http://regit.500px.com/
From 5ec3879993c502f808d78c750f585555a0cd3014 Mon Sep 17 00:00:00 2001
From: Eric Leblond <eric@xxxxxxxxx>
Date: Tue, 17 Jul 2012 23:04:46 +0200
Subject: [PATCH] Modify IPv6 logic
---
utils/conntrack_filter.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/utils/conntrack_filter.c b/utils/conntrack_filter.c
index a3eeebc..cfde5d4 100644
--- a/utils/conntrack_filter.c
+++ b/utils/conntrack_filter.c
@@ -74,9 +74,10 @@ int main(void)
/* ignore whatever that comes from ::1 (loopback) */
nfct_filter_set_logic(filter,
NFCT_FILTER_SRC_IPV6,
- NFCT_FILTER_LOGIC_NEGATIVE);
+ NFCT_FILTER_LOGIC_POSITIVE);
nfct_filter_add_attr(filter, NFCT_FILTER_SRC_IPV6, &filter_ipv6);
+ nfct_filter_add_attr(filter, NFCT_FILTER_DST_IPV6, &filter_ipv6);
if (nfct_filter_attach(nfct_fd(h), filter) == -1) {
perror("nfct_filter_attach");
--
1.7.10.4
Attachment:
signature.asc
Description: This is a digitally signed message part
