Hi, There is currently an open issue with nft in that ah expression doesn't work for IPv6 since it creates a payload expression which doesn't find the AH IPv6 extension header. There has been a discussion about this problem off-list in which two alternative "solutions" were named, both involve checking the context to find out whether one is trying to match an IPv4 or IPv6 packet and then create either payload or exthdr expression. Though this solution is not optimal, as in (at least) inet table the address family is not given per se. I had the idea of creating a "real" solution to the problem which consists of a payload/exthdr hybrid in kernel space searching for the given header in different locations depending on the family of the actual package being handled. Ideally this should reuse as much code as possible, so maybe "just" create both expressions in user space and in kernel space only branch between the two. This is merely a rough idea and I probably miss some obstacles which have to be overcome in order to make this work. What are your opinions on that? Do you think something like that could work, or do you have a better idea to fix this problem? Thanks, Phil -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
