From bb498c8ba7bb3cba3678521d2d39fc0be28a7671 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 25 Nov 2016 17:32:39 +0100 Subject: extensions: libip6t_ah: Fix translation of plain '-m ah' This is actually a limitation of ip6tables: | # ip6tables -A INPUT -p ah -j ACCEPT | Warning: never matched protocol: ah. use extension match instead. The working alternative is like so: | # ip6tables -A INPUT -m ah -j ACCEPT But upon translating, this statement gets ignored: | $ ip6tables-translate -A INPUT -m ah -j ACCEPT | nft add rule ip6 filter INPUT counter accept This patch (ab)uses the 'space' variable to check if a parameter to the 'ah' match was present and if not translates the match into an extension header check: | $ ip6tables-translate -A INPUT -m ah -j ACCEPT | add rule ip6 filter INPUT meta l4proto ah counter accept Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- extensions/libip6t_ah.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'extensions/libip6t_ah.c') diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c index 5c2fe558..f35982f3 100644 --- a/extensions/libip6t_ah.c +++ b/extensions/libip6t_ah.c @@ -152,8 +152,13 @@ static int ah_xlate(struct xt_xlate *xl, space = " "; } - if (ahinfo->hdrres != 0) + if (ahinfo->hdrres != 0) { xt_xlate_add(xl, "%sah reserved %u", space, ahinfo->hdrres); + space = " "; + } + + if (!space[0]) /* plain '-m ah' */ + xt_xlate_add(xl, "meta l4proto ah"); return 1; } -- cgit v1.2.3