Supporting IPv6 in this part might be tricky, because it is creating an Unified2 IPv4 alert. So, if the packet is IPv4 and the HTTP X-Forwarded-For header comes with an IPv6 address, we cannot override the Unified2 alert source/destination address. In this case the override mode of the XFF patch cannot be used.

Even if we go the route "lets create a IPv6 Unified2 alert type instead, it won't be good enough because we will have a mix of IPv6/IPv4 addresses in the alert.

The override mode is pretty useful since barnyard (from what I know) does not care about the extra data structure were we can specify the actual client IP address. Any ideas on how to get around this without dropping the override mode?