ironcore-dev / ironcore-dev/dpservice
Define how to handle NAT64 packets in firewall
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 17
- Forks
- 10
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 5
Description
Summary
In the current Firewall API, it is possible to mix IP types for src and destination ip addresses.
This needs to be prevented. A rule should be either ipv4 or ipv6 address family.
(To keep the implementation less complex)
If a rule needs to match both ipv4 and ipv6 ports then two rules need to be created.
This double rule approach will also cover NAT64 packets.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Firewall API and trace how source and destination IP address families are accepted when a rule is created. Done means mixed IPv4/IPv6 rules are rejected, while separate rules for each family provide the documented NAT64 coverage; verify the behavior with the existing firewall tests if available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100