diff options
| author | Phil Sutter <phil@nwl.cc> | 2024-02-01 15:42:10 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2024-02-02 18:26:14 +0100 |
| commit | 83f60fb37d594d1984a4e8a197d8f99eb8b2db30 (patch) | |
| tree | 03ee552754b8e5faef6099979d3d5acb389efe36 /extensions/libip6t_mh.txlate | |
| parent | d71eb186e7d165d7120f122dd07c35cd935a1955 (diff) | |
extensions: mh: Save/xlate inverted full ranges
Also translate '-m mh' into an exthdr exists match unless '-p mh' is
also present. The latter is converted into 'meta l4proto mh' which might
need fixing itself at a later point.
Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libip6t_mh.txlate')
| -rw-r--r-- | extensions/libip6t_mh.txlate | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate index 825c9569..3364ce57 100644 --- a/extensions/libip6t_mh.txlate +++ b/extensions/libip6t_mh.txlate @@ -8,7 +8,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT -nft 'add rule ip6 filter INPUT counter accept' +nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT -nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' +nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' |