diff options
author | Phil Sutter <phil@nwl.cc> | 2016-11-25 17:32:39 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-11-29 23:03:50 +0100 |
commit | bb498c8ba7bb3cba3678521d2d39fc0be28a7671 (patch) | |
tree | 9ee052732e95f5757e657b43724f00b821d941c5 /m4 | |
parent | 36e7d239dd721a60f9bf3191ae50e726c34ee50d (diff) |
extensions: libip6t_ah: Fix translation of plain '-m ah'
This is actually a limitation of ip6tables:
| # ip6tables -A INPUT -p ah -j ACCEPT
| Warning: never matched protocol: ah. use extension match instead.
The working alternative is like so:
| # ip6tables -A INPUT -m ah -j ACCEPT
But upon translating, this statement gets ignored:
| $ ip6tables-translate -A INPUT -m ah -j ACCEPT
| nft add rule ip6 filter INPUT counter accept
This patch (ab)uses the 'space' variable to check if a parameter to the
'ah' match was present and if not translates the match into an extension
header check:
| $ ip6tables-translate -A INPUT -m ah -j ACCEPT
| add rule ip6 filter INPUT meta l4proto ah counter accept
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'm4')
0 files changed, 0 insertions, 0 deletions