Warning: never matched protocol: ah. use extension match instead.

Warning: never matched protocol: ah. use extension match instead.

[Thomas Jacob]

[-- Attachment #1: Type: text/plain, Size: 546 bytes --]

Could someone clarify what exactly the warning message in the subject
(from ip6tables) is supposed to tell me?

It looks like that ip6tables -p ah (or -p in general) would match
packets that contain an ah header as the last extension header whereas
-m ah matches packets that contain an ah header at any position, but
I'm not sure.

The core of the question is this: how does one pass unspecified
ipsec traffic in ip6tables (the way you could do with -p ah + -p esp in
iptables)?


  Thanks & Regards,
      Thomas









[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Warning: never matched protocol: ah. use extension match instead.

[Patrick McHardy]

Thomas Jacob wrote:
> Could someone clarify what exactly the warning message in the subject
> (from ip6tables) is supposed to tell me?
> 
> It looks like that ip6tables -p ah (or -p in general) would match
> packets that contain an ah header as the last extension header whereas
> -m ah matches packets that contain an ah header at any position, but
> I'm not sure.

Almost. "-p" uses the first non-extension header (which can never
be AH), while "-m ah" matches on AH extension headers.

> The core of the question is this: how does one pass unspecified
> ipsec traffic in ip6tables (the way you could do with -p ah + -p esp in
> iptables)?

"-m ah" and both "-m esp" and "-p esp" should work.

Re: Warning: never matched protocol: ah. use extension match instead.

[Jan Engelhardt]

On Monday 2008-06-23 15:55, Thomas Jacob wrote:

>Could someone clarify what exactly the warning message in the subject
>(from ip6tables) is supposed to tell me?
>
>It looks like that ip6tables -p ah (or -p in general) would match
>packets that contain an ah header as the last extension header whereas
>-m ah matches packets that contain an ah header at any position, but
>I'm not sure.
>
>The core of the question is this: how does one pass unspecified
>ipsec traffic in ip6tables (the way you could do with -p ah + -p esp in
>iptables)?

AH is never the last header in IPv6 (TCP/etc. follows), hence the warning.
But ESP can be the last one.
(And -p esp won't throw a warning.)