Summary
In the current Firewall API, it is possible to mix IP types for src and destination ip addresses.
This needs to be prevented. A rule should be either ipv4 or ipv6 address family.
(To keep the implementation less complex)
If a rule needs to match both ipv4 and ipv6 ports then two rules need to be created.
This double rule approach will also cover NAT64 packets.
Summary
In the current Firewall API, it is possible to mix IP types for src and destination ip addresses.
This needs to be prevented. A rule should be either ipv4 or ipv6 address family.
(To keep the implementation less complex)
If a rule needs to match both ipv4 and ipv6 ports then two rules need to be created.
This double rule approach will also cover NAT64 packets.