Re: [RFC] ecn match ported to ipv6

[Patrick McHardy <kaber@trash.net>]

On 08.06.2011 22:50, Jan Engelhardt wrote:
> On Wednesday 2011-06-08 19:32, Patrick McHardy wrote:
> 
>> On 08.06.2011 17:47, Dave Taht wrote:
>>> On Wed, Jun 8, 2011 at 9:01 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
>>>
>>>> Dave Taht mentioned in bloat list that netfilter ecn match was ipv4
>>>> only.
>>>>
>>>> Is there any plan to make the switch from net/ipv4/netfilter/ipt_ecn.c
>>>> to net/netfilter/xt_ecn.c ?
>>>>
>>>> I can probably do it but not before ~ten days, so if someone is
>>>> interested, this will please Dave ;)
>>
>> That should be a relatively quick job, I'll give it a shot while
>> my dinner is cooking :)
>>
>>> The larger question I had was this
>>>
>>> "iptables seems to think ecn can only be looked at in TCP streams, where (for
>>> example), ecn bits can be copied to the outer header of a udp vpn
>>> stream, and marked
>>>
>>> when needed."
>>>
>>> ECN is an ip level standard, not just a tcp one.
>>
>> That probably needs a new revision and is slightly more work, lets
>> begin by porting it to IPv6, then we can add this on top.
> 
> Moving it to xt_ecn first seems like producing a smaller patchset 
> because you don't have to potentially duplicate the functions first. :)

It actually already supports matching on IP header ECN bits:

[!] --ecn-ip-ect [0..3]	Match ECN codepoint in IPv4 header