ulogd: logging IPv6 flows

Martin Mareš <[email protected]> Wed, 1 Apr 2026 13:55:09 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
Hello, world!\n

I am trying to use ulogd2 to log all flows from conntrack,
but I am getting corrupted entries for IPv6 connections.

Instead of IPv6 addresses of endpoints, I am getting IPv4 addresses.
Apparently, the bytes in memory are interpreted as IPv4: for an
IPv6 address starting with 2001:0718:, I see 32.1.7.24.

A quick glance at input/flow/ulogd_inpflow_NFCT.c suggests that
both IPv4 and IPv6 source addresses are stored under the NFCT_ORIG_IP_SADDR
key, but the nfct_okeys array has a fixed ULOGD_RET_IPADDR type for it.

I tested ulogd2 2.0.8 from Debian Trixie, but I checked that the revelants
bits of the plugin's source does not differ between 2.0.8 and 2.0.9.

				Have a nice fortnight
-- 
Martin `MJ' Mareš                        <[email protected]>   http://mj.ucw.cz/
United Computer Wizards, Prague, Czech Republic, Europe, Earth, Universe