diff options
author | Phil Sutter <phil@nwl.cc> | 2016-11-25 17:32:39 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-11-29 23:03:50 +0100 |
commit | bb498c8ba7bb3cba3678521d2d39fc0be28a7671 (patch) | |
tree | 9ee052732e95f5757e657b43724f00b821d941c5 /extensions | |
parent | 36e7d239dd721a60f9bf3191ae50e726c34ee50d (diff) |
extensions: libip6t_ah: Fix translation of plain '-m ah'
This is actually a limitation of ip6tables:
| # ip6tables -A INPUT -p ah -j ACCEPT
| Warning: never matched protocol: ah. use extension match instead.
The working alternative is like so:
| # ip6tables -A INPUT -m ah -j ACCEPT
But upon translating, this statement gets ignored:
| $ ip6tables-translate -A INPUT -m ah -j ACCEPT
| nft add rule ip6 filter INPUT counter accept
This patch (ab)uses the 'space' variable to check if a parameter to the
'ah' match was present and if not translates the match into an extension
header check:
| $ ip6tables-translate -A INPUT -m ah -j ACCEPT
| add rule ip6 filter INPUT meta l4proto ah counter accept
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions')
-rw-r--r-- | extensions/libip6t_ah.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c index 5c2fe558..f35982f3 100644 --- a/extensions/libip6t_ah.c +++ b/extensions/libip6t_ah.c @@ -152,8 +152,13 @@ static int ah_xlate(struct xt_xlate *xl, space = " "; } - if (ahinfo->hdrres != 0) + if (ahinfo->hdrres != 0) { xt_xlate_add(xl, "%sah reserved %u", space, ahinfo->hdrres); + space = " "; + } + + if (!space[0]) /* plain '-m ah' */ + xt_xlate_add(xl, "meta l4proto ah"); return 1; } |