Florian, do we have the same test for every bit in the ipv6 address both matching/unmatching ? If not, would it be possible to add this to confirm that we are matching all the bits in the ipv6 address. Also, a general question, where is this netfilter code maintained ? I found this github where the code is present "GitHub - torvalds/linux: Linux kernel source tree" but couldn't see this fix in Pull request. Regards, Sontu On Fri, Apr 4, 2025 at 5:21 PM Stefano Brivio <sbrivio@xxxxxxxxxx> wrote: > > On Fri, 4 Apr 2025 08:20:54 +0200 > Florian Westphal <fw@xxxxxxxxx> wrote: > > > Without 'nft_set_pipapo: fix incorrect avx2 match of 5th field octet" > > this fails: > > > > TEST: reported issues > > Add two elements, flush, re-add 1s [ OK ] > > net,mac with reload 0s [ OK ] > > net,port,proto 3s [ OK ] > > avx2 false match 0s [FAIL] > > False match for fe80:dead:01fe:0a02:0b03:6007:8009:a001 > > > > Other tests do not detect the kernel bug as they only alter parts in > > the /64 netmask. > > > > Signed-off-by: Florian Westphal <fw@xxxxxxxxx> > > Reviewed-by: Stefano Brivio <sbrivio@xxxxxxxxxx> > > -- > Stefano >
