ipv6 conntrack status?

ipv6 conntrack status?

[Saku Ytti]

Hey,

I'm running 2.6.16-rc4, I've rolled and installed:
conntrack_1.00beta1_amd64.deb
libconntrack-extensions_1.00beta1_amd64.deb
libnetfilter-conntrack1_0.0.30_amd64.deb
libnetfilter-conntrack-dev_0.0.30_amd64.deb
libnfnetlink0_0.0.14_amd64.deb
libnfnetlink-dev_0.0.14_amd64.deb

I checked SVN for iptables 1.4 branch, but couldn't see ip6 conntrack.

[root@ip.fi ~]# conntrack -L -f ipv6
Operation failed: Unknown error 18446744073709551519

ipv4 works perfectly. What am I missing? I couldn't really find any
documentation how the new architecture should be configured, if there
is such, please point me to it.

I've previously used ipv6 conntrack from usagi patched without problems.

Thanks,

-- 
  ++ytti

Re: ipv6 conntrack status?

[Yasuyuki KOZAKAI]

From: Saku Ytti <saku@ytti.fi>
Date: Sat, 25 Feb 2006 13:13:16 +0200

> Hey,
> 
> I'm running 2.6.16-rc4, I've rolled and installed:
> conntrack_1.00beta1_amd64.deb
> libconntrack-extensions_1.00beta1_amd64.deb
> libnetfilter-conntrack1_0.0.30_amd64.deb
> libnetfilter-conntrack-dev_0.0.30_amd64.deb
> libnfnetlink0_0.0.14_amd64.deb
> libnfnetlink-dev_0.0.14_amd64.deb
> 
> I checked SVN for iptables 1.4 branch, but couldn't see ip6 conntrack.
> 
> [root@ip.fi ~]# conntrack -L -f ipv6
> Operation failed: Unknown error 18446744073709551519
> 
> ipv4 works perfectly. What am I missing? I couldn't really find any
> documentation how the new architecture should be configured, if there
> is such, please point me to it.
> 
> I've previously used ipv6 conntrack from usagi patched without problems.

You can use nf_conntrack_ipv6 in mainline kernel, not ip6_conntrack.
To build it, please disable IP_NF_CONNTRACK, enable NF_CONNTRACK and
NF_CONNTRACK_IPV6. NF_CONNTRACK is in the menu "Core Netfilter Configuration",
and NF_CONNTRACK_IPV6 in the menu "IPv6: Netfilter Configuration
(EXPERIMENTAL)".

Regards,

-- Yasuyuki Kozakai

Re: ipv6 conntrack status?

[Saku Ytti]

[-- Attachment #1: Type: text/plain, Size: 482 bytes --]

On (2006-03-03 02:41 +0900), Yasuyuki KOZAKAI wrote:

> You can use nf_conntrack_ipv6 in mainline kernel, not ip6_conntrack.
> To build it, please disable IP_NF_CONNTRACK, enable NF_CONNTRACK and
> NF_CONNTRACK_IPV6. NF_CONNTRACK is in the menu "Core Netfilter Configuration",
> and NF_CONNTRACK_IPV6 in the menu "IPv6: Netfilter Configuration
> (EXPERIMENTAL)".

Indeed menuconfig hides the new conntrack if old one is chosen,
as was my case.

Thanks!

-- 
  ++ytti

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: ipv6 conntrack status?

[Patrick McHardy]

Saku Ytti wrote:
> On (2006-03-03 02:41 +0900), Yasuyuki KOZAKAI wrote:
> 
> 
>>You can use nf_conntrack_ipv6 in mainline kernel, not ip6_conntrack.
>>To build it, please disable IP_NF_CONNTRACK, enable NF_CONNTRACK and
>>NF_CONNTRACK_IPV6. NF_CONNTRACK is in the menu "Core Netfilter Configuration",
>>and NF_CONNTRACK_IPV6 in the menu "IPv6: Netfilter Configuration
>>(EXPERIMENTAL)".
> 
> 
> Indeed menuconfig hides the new conntrack if old one is chosen,
> as was my case.

Maybe we can find a better way to choose between the two conntrack
implementations. Right now its really confusing, IP_NF_CONNTRACK
hides NF_CONNTRACK, but if NF_CONNTRACK is selected I can still
choose IP_NF_CONNTRACK even though it won't work. Maybe a
"choice" option?