Re: ulogd: logging IPv6 flows

--YWpUTwx8ogLNEFo5
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 2026-04-02, at 14:37:32 +0200, Martin Mare=C5=A1 wrote:
> > The use of `ULOGD_RET_IPADDR` for both families is (or should be) fine.
> > My guess is that there is a filter which expects `ULOGD_RET_IPADDR`
> > fields always to be IPv4.  I thought I had fixed all of those.  I will
> > investigate.  Can you tell me the whole stack?
>=20
> My stack is just:
>=20
> stack=3Dct1:NFCT,nacct1:GPRINT
>=20
> [ct1]
> netlink_socket_buffer_size=3D1048576
> netlink_socket_buffer_maxsize=3D10485760
> hash_enable=3D0
>=20
> [nacct1]
> file=3D/var/log/ulog/flows.log
> sync=3D0
> timestamp=3D1

The problem is that GPRINT (and OPRINT) used not to handle IPv6
addresses correctly.  I fixed this a couple of years ago and the fixes
were released in 2.0.9 (which is currently in Debian Testing and will be
in Forky); however, the version in Trixie, as you are aware, is 2.0.8.

As a work-around, you could use the IP2STR filter, which does handle
IPv6 addresses correctly:

	stack=3Dct1:NFCT,ip2str1:IP2STR,nacct1:GPRINT

As the name implies, it converts the addresses to strings.  The output
keys for the strings are the input keys plus ".str" ("orig.ip.saddr.str"
and so on).  The result is output like this (reformatted for
legibility):

	timestamp=3D2026/04/02-16:15:53,
	orig.ip.saddr=3D32.1.8.176,
	orig.ip.daddr=3D42.5.180.0,
	orig.ip.protocol=3D17,
	orig.l4.sport=3D47294,
	orig.l4.dport=3D123,
	orig.raw.pktlen=3D0,
	orig.raw.pktcount=3D0,
	reply.ip.saddr=3D42.5.180.0,
	reply.ip.daddr=3D32.1.8.176,
	reply.ip.protocol=3D17,
	reply.l4.sport=3D123,
	reply.l4.dport=3D47294,
	reply.raw.pktlen=3D0,
	reply.raw.pktcount=3D0,
	ct.mark=3D0,
	ct.id=3D1615795605,
	ct.event=3D4,
	flow.end.sec=3D1775142953,
	flow.end.usec=3D478848,
	oob.family=3D10,
	oob.protocol=3D0,
	orig.ip.saddr.str=3D2001:8b0:fb7d:d6d7:2e4d:54ff:fe4b:a9ae,
	orig.ip.daddr.str=3D2a05:b400:c::123:63,
	reply.ip.saddr.str=3D2a05:b400:c::123:63,
	reply.ip.daddr.str=3D2001:8b0:fb7d:d6d7:2e4d:54ff:fe4b:a9ae

J.

--YWpUTwx8ogLNEFo5
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

wsG7BAABCgBvBYJpzoymCRAphqwKvfEEDUcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmdv8H7H5sja/LCvL8V0RccahD2qUqeYRcUBft7OJc48
0RYhBGwdtFNj70A3vVbVFymGrAq98QQNAAAAMRAApqzq5U7kTVU8MOtN4+NCP+Zx
5fzEkRb2aFoKEViITNDGfGuyNhRab6Nv/2MMlfXcPx77yPFxPrlHSTnZ4VpSHW7l
wGNlMTSfkiL3SGbC2aKdz3eZ3ZXz2/8mwKim9vUfKv4012dpuw++Wx1ToIXO7R7y
I88AUGtfSnleqs/mxCMqPy/3lacvkAJog6RJvVB7F0H+Jh94jONHSqzdX39WYrPx
nZvojXE7OE5Hs3bMzKYfhZZJ7wJiOrwmrTpnA2wKo7PtuFSCkw/UvMSCvCyfWCfS
jeVBpnDXHmzSyvcUFt8FGNSN2tD3EDDuuFTxfBCfTTYBZ9cio9sGS9yWb1q97h6J
GsJhrzEjr4ITJEOwliaQB/Q99v4RisPeEAo5iySbXZtJHpbPURLIswyKPMEQdb10
fvUAZnaVvvQS3SOWCp4Plt4kpxbQVjZdUNmXxIoQA6VbZllystbFRqtt/tnWoIOA
PwHqvCtfH1PKdxHcWeETj4y8JMXRWH/kkImWmWw4oBjVw5qL178ImP5j4OR/kdoO
aQWJ7hhEfbMbUW7GwFARoxtbQ9ta4YF8zfW7kMbcUk0DB/p8cuUWMwAxi7G6AC3B
EM4Ag4i1y3ILNmW2kYl+4+XmYpKrZoqlu8WaPaDDMfjYno2yDInV3Chr0bqF9n+X
Q9YCj0ep2uz/nEtM4tg=
=B75x
-----END PGP SIGNATURE-----

--YWpUTwx8ogLNEFo5--