[PATCH] ipv6 support for libnetfilter_conntrack

[PATCH] ipv6 support for libnetfilter_conntrack

[Pablo Neira Ayuso]

Hi Yasuyuki,

JFYI: I just added support for ipv6 to libnetfilter. I'll commit the
changes by myself once the new version of libnetfilter_conntrack is
released.

http://people.netfilter.org/pablo/libnetfilter-conntrack-ipv6.patch

-- 
Pablo

Re: [PATCH] ipv6 support for libnetfilter_conntrack

[Pablo Neira Ayuso]

Pablo Neira Ayuso wrote:
> Hi Yasuyuki,
> 
> JFYI: I just added support for ipv6 to libnetfilter. I'll commit the
> changes by myself once the new version of libnetfilter_conntrack is
> released.
> 
> http://people.netfilter.org/pablo/libnetfilter-conntrack-ipv6.patch

And the conntrack-tool patch, still untested:

http://people.netfilter.org/pablo/conntrack-ipv6.patch

-- 
Pablo

Re: [PATCH] ipv6 support for libnetfilter_conntrack

[Yasuyuki KOZAKAI]

Hi, Pablo,

From: Pablo Neira Ayuso <pablo@eurodev.net>
Date: Tue, 20 Dec 2005 01:25:41 +0100

> Pablo Neira Ayuso wrote:
> > Hi Yasuyuki,
> > 
> > JFYI: I just added support for ipv6 to libnetfilter. I'll commit the
> > changes by myself once the new version of libnetfilter_conntrack is
> > released.
> > 
> > http://people.netfilter.org/pablo/libnetfilter-conntrack-ipv6.patch
> 
> And the conntrack-tool patch, still untested:
> 
> http://people.netfilter.org/pablo/conntrack-ipv6.patch

Great, I'll read deeply them this weekend.

BTW, I couldn't compile conntrack with these patches. 'union nfct_address'
seems not to be declared. If you will declare this union and use it
in libnetfilter_conntrack/include/libnetfilter_conntrack.h, I think you'd
better to do it before release.

And in __parse_inetaddr() in conntrack-ipv6.patch,

+	else if (inet_pton(AF_INET6, cp, &parse->addr6))
+		return AF_INET6;

this should be

+	else if (inet_pton(AF_INET6, cp, &parse->addr6) > 0)
+		return AF_INET6;

The only positive return value means success.

Regards,

-- Yasuyuki Kozakai

Re: [PATCH] ipv6 support for libnetfilter_conntrack

[Pablo Neira Ayuso]

Yasuyuki KOZAKAI wrote:
>>Pablo Neira Ayuso wrote:
>>>JFYI: I just added support for ipv6 to libnetfilter. I'll commit the
>>>changes by myself once the new version of libnetfilter_conntrack is
>>>released.
>>>
>>>http://people.netfilter.org/pablo/libnetfilter-conntrack-ipv6.patch
>>
>>And the conntrack-tool patch, still untested:
>>
>>http://people.netfilter.org/pablo/conntrack-ipv6.patch
> 
> Great, I'll read deeply them this weekend.
> 
> BTW, I couldn't compile conntrack with these patches. 'union nfct_address'
> seems not to be declared. If you will declare this union and use it
> in libnetfilter_conntrack/include/libnetfilter_conntrack.h, I think you'd
> better to do it before release.

Hm, maybe you have an old working copy. I commited that change ~8 hours
ago, see SVN ;)

> And in __parse_inetaddr() in conntrack-ipv6.patch,
> 
> +	else if (inet_pton(AF_INET6, cp, &parse->addr6))
> +		return AF_INET6;
> 
> this should be
> 
> +	else if (inet_pton(AF_INET6, cp, &parse->addr6) > 0)
> +		return AF_INET6;
> 
> The only positive return value means success.

I must be missing anything. From inet_pton manpage:

The inet_pton() function shall return 1 if the  conversion succeeds,
with the  address  pointed  to  by dst in network byte order. It shall
return 0 if the input is not a valid IPv4 dotted-decimal string or a
valid  IPv6  address string,  or -1 with errno set to [EAFNOSUPPORT] if
the af argument is unknown.

Still required such change? Thanks!

-- 
Pablo

Re: [PATCH] ipv6 support for libnetfilter_conntrack

[Yasuyuki KOZAKAI]

From: Pablo Neira Ayuso <pablo@eurodev.net>
Date: Wed, 21 Dec 2005 18:26:34 +0100

> Yasuyuki KOZAKAI wrote:
> >>Pablo Neira Ayuso wrote:
> >>>JFYI: I just added support for ipv6 to libnetfilter. I'll commit the
> >>>changes by myself once the new version of libnetfilter_conntrack is
> >>>released.
> >>>
> >>>http://people.netfilter.org/pablo/libnetfilter-conntrack-ipv6.patch
> >>
> >>And the conntrack-tool patch, still untested:
> >>
> >>http://people.netfilter.org/pablo/conntrack-ipv6.patch
> > 
> > Great, I'll read deeply them this weekend.
> > 
> > BTW, I couldn't compile conntrack with these patches. 'union nfct_address'
> > seems not to be declared. If you will declare this union and use it
> > in libnetfilter_conntrack/include/libnetfilter_conntrack.h, I think you'd
> > better to do it before release.
> 
> Hm, maybe you have an old working copy. I commited that change ~8 hours
> ago, see SVN ;)

Now I can build. Thanks.

> > And in __parse_inetaddr() in conntrack-ipv6.patch,
> > 
> > +	else if (inet_pton(AF_INET6, cp, &parse->addr6))
> > +		return AF_INET6;
> > 
> > this should be
> > 
> > +	else if (inet_pton(AF_INET6, cp, &parse->addr6) > 0)
> > +		return AF_INET6;
> > 
> > The only positive return value means success.
> 
> I must be missing anything. From inet_pton manpage:
> 
> The inet_pton() function shall return 1 if the  conversion succeeds,
> with the  address  pointed  to  by dst in network byte order. It shall
> return 0 if the input is not a valid IPv4 dotted-decimal string or a
> valid  IPv6  address string,  or -1 with errno set to [EAFNOSUPPORT] if
> the af argument is unknown.
> 
> Still required such change? Thanks!

I think nowadays inet_pton() in almost distributions support AF_INET6, too.
But I don't want to assume that.

-- Yasuyuki Kozakai

Re: [PATCH] ipv6 support for libnetfilter_conntrack

[Pablo Neira Ayuso]

Yasuyuki KOZAKAI wrote:
>>>And in __parse_inetaddr() in conntrack-ipv6.patch,
>>>
>>>+	else if (inet_pton(AF_INET6, cp, &parse->addr6))
>>>+		return AF_INET6;
>>>
>>>this should be
>>>
>>>+	else if (inet_pton(AF_INET6, cp, &parse->addr6) > 0)
>>>+		return AF_INET6;
>>>
>>>The only positive return value means success.
>>
>>I must be missing anything. From inet_pton manpage:
>>
>>The inet_pton() function shall return 1 if the  conversion succeeds,
>>with the  address  pointed  to  by dst in network byte order. It shall
>>return 0 if the input is not a valid IPv4 dotted-decimal string or a
>>valid  IPv6  address string,  or -1 with errno set to [EAFNOSUPPORT] if
>>the af argument is unknown.
>>
>>Still required such change? Thanks!
> 
> I think nowadays inet_pton() in almost distributions support AF_INET6, too.
> But I don't want to assume that.

OK. I'll also add some extra checkings for inet_pton() at ./configure stage.

-- 
Pablo