Subject: Re: ipfilter 3.4beta - ipv6 filtering.
To: None <thorpej@nas.nasa.gov>
From: Darren Reed <darrenr@reed.wattle.id.au>
List: tech-net
Date: 02/20/2000 00:08:49
In some email I received from Jason Thorpe, sie wrote:
> 
> On Sun, 20 Feb 100 18:50:25 +1100 (EST) 
>  Darren Reed <darrenr@reed.wattle.id.au> wrote:
> 
>  > The way I've developed the code is such that it is different so it can
>  > run on non-IPv6 systems.  NetBSD 1.5 will be an IPv6 system, thus it
>  > will be possible to compile it all as IPv4/IPv6 and only have the pfil
>  > hook dependant on INET6, keeping the API the same.
> 
> That's nonsense.  It's possible to build the NetBSD userland WITHOUT
> INET6, and doing so does NOT break any ABI compatibility with the kernel.
> 
>  > > 	If the API is kept same regardless from "options INET6" it should
>  > > 	be okay.  (always use 16bytes, or use sockaddr/sockaddr_storage
>  > > 	- sockaddr comes with indication of address family so it is better
>  > > 	than passing in{,6}_addr) 
>  > 
>  > The filter rules already have the 'version' in them, so ipfilter knows
>  > what the 16 bytes are (v4/v6).
> 
> ....begs the question of why you didn't use sockaddrs from the start,
> but I'm not sure I want to know the answer to that question.

Lets see, do I compare 16 odd bytes with another 20 odd bytes and compare
them with another 16 odd bytes to see if 4 out of each 16 match up for a
particular rule ?  It was originally developed *for* IPv4 and IPv4 only.

That and size limits on structures passed via ioctl.  It was originally
developed back when we didn't have more MHz than Megabucks and so is/was
efficient as possible where possible.