Re: NPF issue with inet6($if) vs. ifaddrs($if)

[mlelstv%serpens.de@localhost (Michael van Elst)]

anthony.mallet%laas.fr@localhost (Anthony Mallet) writes:

>On Thursday 17 Nov 2022, at 08:02, Michael van Elst wrote:
>> ifaddrs() works by creating a small table that you can search
>> for an interface address. A compiled match (inet6()) can only
>> work for static addresses.

>OK, I got it.

>I feel that ifaddrs() does not add a significant overhead compared to
>inet6(), does it? And that may even be a more robust config after
>all, for instance when using IPv6 privacy extensions.

Also if you use lots of addresses (easy to do with temporary addresses)
the generated code becomes too large.


>I looked at the npf byte compiler, but fixing inet6() for a list does
>not seem like a trivial fix ...

I have a local fix, but I'm not sure if it is correct and the resulting
bytecode could be better.