summaryrefslogtreecommitdiffstats
path: root/m4
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2016-11-25 17:32:39 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2016-11-29 23:03:50 +0100
commitbb498c8ba7bb3cba3678521d2d39fc0be28a7671 (patch)
tree9ee052732e95f5757e657b43724f00b821d941c5 /m4
parent36e7d239dd721a60f9bf3191ae50e726c34ee50d (diff)
extensions: libip6t_ah: Fix translation of plain '-m ah'
This is actually a limitation of ip6tables: | # ip6tables -A INPUT -p ah -j ACCEPT | Warning: never matched protocol: ah. use extension match instead. The working alternative is like so: | # ip6tables -A INPUT -m ah -j ACCEPT But upon translating, this statement gets ignored: | $ ip6tables-translate -A INPUT -m ah -j ACCEPT | nft add rule ip6 filter INPUT counter accept This patch (ab)uses the 'space' variable to check if a parameter to the 'ah' match was present and if not translates the match into an extension header check: | $ ip6tables-translate -A INPUT -m ah -j ACCEPT | add rule ip6 filter INPUT meta l4proto ah counter accept Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'm4')
0 files changed, 0 insertions, 0 deletions