netfilter IPv6 support

netfilter IPv6 support

[Thomas Zehetbauer]

[-- Attachment #1: Type: text/plain, Size: 458 bytes --]

Although linux was one of the first to support IPv6 it seems to me that
netfilter support has almost stuck. There is still not even a REJECT
target not to mention stateful filtering for IPv6.

Tom

-- 
  T h o m a s   Z e h e t b a u e r   ( TZ251 )
  PGP encrypted mail preferred - KeyID 96FFCB89
      finger thomasz@hostmaster.org for key

The horizon of many people is a circle with a radius of zero.
They call this their point of view.



[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 481 bytes --]

Re: netfilter IPv6 support

[David S. Miller]

On Thu, 26 Aug 2004 20:52:47 +0200
Thomas Zehetbauer <thomasz@hostmaster.org> wrote:

> Although linux was one of the first to support IPv6 it seems to me that
> netfilter support has almost stuck. There is still not even a REJECT
> target not to mention stateful filtering for IPv6.

Why not ask the netfilter development lists such questions?

Stateful netfilter is not there because it's a total waste
to completely duplicate all of the connection tracking et al.
code into ipv6 counterparts when %80 of the code is roughly
the same.  People are working on a consolidation of these
things so that there is no code duplication but it is a lot
of work and there are bigger fires to put out at the moment.

Re: netfilter IPv6 support

[Thomas Zehetbauer]

[-- Attachment #1: Type: text/plain, Size: 872 bytes --]

On Don, 2004-08-26 at 13:00 -0700, David S. Miller wrote:
> Stateful netfilter is not there because it's a total waste
> to completely duplicate all of the connection tracking et al.
> code into ipv6 counterparts when %80 of the code is roughly
> the same.  People are working on a consolidation of these
> things so that there is no code duplication but it is a lot
> of work and there are bigger fires to put out at the moment.

Of course it's a waste to duplicate the code but as far as I remember
the status of netfilter for IPv6 has not changed for almost a year. As
said there is still not even the basic REJECT target available.

Tom

-- 
  T h o m a s   Z e h e t b a u e r   ( TZ251 )
  PGP encrypted mail preferred - KeyID 96FFCB89
      finger thomasz@hostmaster.org for key

The three Rs of Microsoft support: Retry, Reboot, Reinstall.



[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 481 bytes --]

Re: netfilter IPv6 support

[Willy Tarreau]

On Thu, Aug 26, 2004 at 11:25:10PM +0200, Thomas Zehetbauer wrote:
> On Don, 2004-08-26 at 13:00 -0700, David S. Miller wrote:
> > Stateful netfilter is not there because it's a total waste
> > to completely duplicate all of the connection tracking et al.
> > code into ipv6 counterparts when %80 of the code is roughly
> > the same.  People are working on a consolidation of these
> > things so that there is no code duplication but it is a lot
> > of work and there are bigger fires to put out at the moment.
> 
> Of course it's a waste to duplicate the code but as far as I remember
> the status of netfilter for IPv6 has not changed for almost a year. As
> said there is still not even the basic REJECT target available.

These features are available in patch-o-matic-ng. They're not in mainline
because the netfilter team only pushes well tested and non-intrusive changes.
But there are lots of people using features from patch-o-matic in production.
You can get those here :

    ftp://ftp.netfilter.org/pub/patch-o-matic-ng/

Please also take a look at the mailing list archives since it's an area
which is currently moving :
 
    http://marc.theaimsgroup.com/?l=netfilter-devel

Regards,
Willy

Re: netfilter IPv6 support

[Thomas Zehetbauer]

[-- Attachment #1: Type: text/plain, Size: 896 bytes --]

On Fre, 2004-08-27 at 00:05 +0200, Willy Tarreau wrote:
> These features are available in patch-o-matic-ng. They're not in mainline
> because the netfilter team only pushes well tested and non-intrusive changes.
> But there are lots of people using features from patch-o-matic in production.

It seems that the netfilter developers are far to conservative in this
case.
- Linux 2.6 is itself is still not deemed completely stable.
- IPv6 support is still marked experimental.
So I doubt someone would blame them for pushing a not so well tested
patch in this case but the current netfilter implementation for IPv6 is
far from useful completeness.

Tom

-- 
  T h o m a s   Z e h e t b a u e r   ( TZ251 )
  PGP encrypted mail preferred - KeyID 96FFCB89
      finger thomasz@hostmaster.org for key

History has shown that the people who make history do not learn from it.



[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 481 bytes --]

Re: netfilter IPv6 support

[Jeff Garzik]

Thomas Zehetbauer wrote:
> Although linux was one of the first to support IPv6 it seems to me that
> netfilter support has almost stuck. There is still not even a REJECT
> target not to mention stateful filtering for IPv6.


google found for me an ip6_conntrack module, but...  some people make a 
credible argument that stateful filtering doesn't scale beyond small 
networks and small amounts of connections.  As Andi puts it, there is no 
infinite hash.

	Jeff

Re: netfilter IPv6 support

[David S. Miller]

On Thu, 26 Aug 2004 16:25:36 -0400
Jeff Garzik <jgarzik@pobox.com> wrote:

> As Andi puts it, there is no infinite hash.

Using hash tables would be the problem :-)

Longest matching prefix lookup algorithms are a well researched area.
One we have not taken advantage of much at all.  This is more than
evident in our routing and netfilter code and I'm working to do
something about it. :-)

Re: netfilter IPv6 support

[Jeff Garzik]

On Thu, Aug 26, 2004 at 02:06:37PM -0700, David S. Miller wrote:
> On Thu, 26 Aug 2004 16:25:36 -0400
> Jeff Garzik <jgarzik@pobox.com> wrote:
> 
> > As Andi puts it, there is no infinite hash.
> 
> Using hash tables would be the problem :-)
> 
> Longest matching prefix lookup algorithms are a well researched area.
> One we have not taken advantage of much at all.  This is more than
> evident in our routing and netfilter code and I'm working to do
> something about it. :-)


Well, I interpreted Andi's statement as a more general complaint about
the overhead of per-connection resources involved in stateful
firewalling.

For example, a NAT box behind which 32,000 hosts sit, or something like
that :)

	Jeff

Re: netfilter IPv6 support

[Thomas Zehetbauer]

[-- Attachment #1: Type: text/plain, Size: 750 bytes --]

On Don, 2004-08-26 at 17:11 -0400, Jeff Garzik wrote:
> For example, a NAT box behind which 32,000 hosts sit, or something like
> that :)

NAT is limited to count(official addresses)*65535 connections anyway.

One of the most important features of IPv6 is to reconcile today's
interNAT to a homogenous internet as it was before and intended to be.
If someone wants then to put 32k hosts behind a single linux router he
would better provide the necessary hardware for it.

Tom

-- 
  T h o m a s   Z e h e t b a u e r   ( TZ251 )
  PGP encrypted mail preferred - KeyID 96FFCB89
      finger thomasz@hostmaster.org for key

Sacrilegia minuta puniuntur, magna in triumphis feruntur
                                      - Seneca



[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 481 bytes --]