On Thu, Mar 02, 2017 at 08:56:52PM +0100, Phil Sutter wrote: > Hi, > > There is currently an open issue with nft in that ah expression doesn't > work for IPv6 since it creates a payload expression which doesn't find > the AH IPv6 extension header. > > There has been a discussion about this problem off-list in which two > alternative "solutions" were named, both involve checking the context > to find out whether one is trying to match an IPv4 or IPv6 packet and > then create either payload or exthdr expression. Though this solution is > not optimal, as in (at least) inet table the address family is not given > per se. > > I had the idea of creating a "real" solution to the problem which > consists of a payload/exthdr hybrid in kernel space searching for the > given header in different locations depending on the family of the > actual package being handled. Ideally this should reuse as much code as > possible, so maybe "just" create both expressions in user space and in > kernel space only branch between the two. If the problem is the inet chain, I would prefer we request explicit dependencies for ah so we generate the right bytecode depending on the family. Yes, I mean we would need two different rules for each case by now. On top of that, do you have a real usecase having both AH traffic for IPv4 and IPv6 traffic? If you don't I would prefer you just fix what we have and focus on a different task, we have plenty of work to do ahead. We can hand over you more useful tasks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
