netfilter IPv6 support
Although linux was one of the first to support IPv6 it seems to me that netfilter support has almost stuck. There is still not even a REJECT target not to mention stateful filtering for IPv6.
Tom
Signature · 6 lines
T h o m a s Z e h e t b a u e r ( TZ251 )
PGP encrypted mail preferred - KeyID 96FFCB89
finger [email protected] for key
The horizon of many people is a circle with a radius of zero.
They call this their point of view.Quoted 3 lines · On Thu, 26 Aug 2004 20:52:47 +0200 Thomas Zehetbauer <[email protected]>…
Although linux was one of the first to support IPv6 it seems to me that netfilter support has almost stuck. There is still not even a REJECT target not to mention stateful filtering for IPv6.
Why not ask the netfilter development lists such questions?
Stateful netfilter is not there because it's a total waste to completely duplicate all of the connection tracking et al. code into ipv6 counterparts when %80 of the code is roughly the same. People are working on a consolidation of these things so that there is no code duplication but it is a lot of work and there are bigger fires to put out at the moment.
Quoted 3 lines · Thomas Zehetbauer
Although linux was one of the first to support IPv6 it seems to me that netfilter support has almost stuck. There is still not even a REJECT target not to mention stateful filtering for IPv6.
google found for me an ip6_conntrack module, but... some people make a credible argument that stateful filtering doesn't scale beyond small networks and small amounts of connections. As Andi puts it, there is no infinite hash.
Jeff
Quoted 1 line · On Thu, 26 Aug 2004 16:25:36 -0400 Jeff Garzik <[email protected]> wrote:
As Andi puts it, there is no infinite hash.
Using hash tables would be the problem :-)
Longest matching prefix lookup algorithms are a well researched area. One we have not taken advantage of much at all. This is more than evident in our routing and netfilter code and I'm working to do something about it. :-)
Quoted 11 lines · David S. Miller
Quoted 1 line · On Thu, 26 Aug 2004 16:25:36 -0400 Jeff Garzik <[email protected]> wrote:
As Andi puts it, there is no infinite hash.
Using hash tables would be the problem :-)
Longest matching prefix lookup algorithms are a well researched area. One we have not taken advantage of much at all. This is more than evident in our routing and netfilter code and I'm working to do something about it. :-)
Well, I interpreted Andi's statement as a more general complaint about the overhead of per-connection resources involved in stateful firewalling.
For example, a NAT box behind which 32,000 hosts sit, or something like that :)
Jeff
Quoted 6 lines · David S. Miller
Stateful netfilter is not there because it's a total waste to completely duplicate all of the connection tracking et al. code into ipv6 counterparts when %80 of the code is roughly the same. People are working on a consolidation of these things so that there is no code duplication but it is a lot of work and there are bigger fires to put out at the moment.
Of course it's a waste to duplicate the code but as far as I remember the status of netfilter for IPv6 has not changed for almost a year. As said there is still not even the basic REJECT target available.
Tom
Signature · 5 lines
T h o m a s Z e h e t b a u e r ( TZ251 )
PGP encrypted mail preferred - KeyID 96FFCB89
finger [email protected] for key
The three Rs of Microsoft support: Retry, Reboot, Reinstall.Quoted 11 lines · Thomas Zehetbauer
Quoted 6 lines · David S. Miller
Stateful netfilter is not there because it's a total waste to completely duplicate all of the connection tracking et al. code into ipv6 counterparts when %80 of the code is roughly the same. People are working on a consolidation of these things so that there is no code duplication but it is a lot of work and there are bigger fires to put out at the moment.
Of course it's a waste to duplicate the code but as far as I remember the status of netfilter for IPv6 has not changed for almost a year. As said there is still not even the basic REJECT target available.
These features are available in patch-o-matic-ng. They're not in mainline because the netfilter team only pushes well tested and non-intrusive changes. But there are lots of people using features from patch-o-matic in production. You can get those here :
ftp://ftp.netfilter.org/pub/patch-o-matic-ng/
Please also take a look at the mailing list archives since it's an area which is currently moving :
http://marc.theaimsgroup.com/?l=netfilter-devel
Regards,
Willy
Quoted 3 lines · Willy Tarreau
These features are available in patch-o-matic-ng. They're not in mainline because the netfilter team only pushes well tested and non-intrusive changes. But there are lots of people using features from patch-o-matic in production.
It seems that the netfilter developers are far to conservative in this case.
- Linux 2.6 is itself is still not deemed completely stable.
- IPv6 support is still marked experimental.
So I doubt someone would blame them for pushing a not so well tested patch in this case but the current netfilter implementation for IPv6 is far from useful completeness.
Tom
Signature · 5 lines
T h o m a s Z e h e t b a u e r ( TZ251 )
PGP encrypted mail preferred - KeyID 96FFCB89
finger [email protected] for key
History has shown that the people who make history do not learn from it.Quoted 2 lines · Jeff Garzik
For example, a NAT box behind which 32,000 hosts sit, or something like that :)
NAT is limited to count(official addresses)*65535 connections anyway.
One of the most important features of IPv6 is to reconcile today's interNAT to a homogenous internet as it was before and intended to be. If someone wants then to put 32k hosts behind a single linux router he would better provide the necessary hardware for it.
Tom
Signature · 6 lines
T h o m a s Z e h e t b a u e r ( TZ251 )
PGP encrypted mail preferred - KeyID 96FFCB89
finger [email protected] for key
Sacrilegia minuta puniuntur, magna in triumphis feruntur
- Seneca