[PATCH] extensions: libip6t_ah: Fix translation of plain '-m ah'

[PATCH] extensions: libip6t_ah: Fix translation of plain '-m ah'

[Phil Sutter]

This is actually a limitation of ip6tables:

| # ip6tables -A INPUT -p ah -j ACCEPT
| Warning: never matched protocol: ah. use extension match instead.

The working alternative is like so:

| # ip6tables -A INPUT -m ah -j ACCEPT

But upon translating, this statement gets ignored:

| $ ip6tables-translate -A INPUT -m ah -j ACCEPT
| nft add rule ip6 filter INPUT  counter accept

This patch (ab)uses the 'space' variable to check if a parameter to the
'ah' match was present and if not translates the match into an extension
header check:

| $ ip6tables-translate -A INPUT -m ah -j ACCEPT
| add rule ip6 filter INPUT meta l4proto ah counter accept

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 extensions/libip6t_ah.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c
index 5c2fe558ec464..f35982f379d76 100644
--- a/extensions/libip6t_ah.c
+++ b/extensions/libip6t_ah.c
@@ -152,8 +152,13 @@ static int ah_xlate(struct xt_xlate *xl,
 		space = " ";
 	}
 
-	if (ahinfo->hdrres != 0)
+	if (ahinfo->hdrres != 0) {
 		xt_xlate_add(xl, "%sah reserved %u", space, ahinfo->hdrres);
+		space = " ";
+	}
+
+	if (!space[0]) /* plain '-m ah' */
+		xt_xlate_add(xl, "meta l4proto ah");
 
 	return 1;
 }
-- 
2.10.0

Re: [PATCH] extensions: libip6t_ah: Fix translation of plain '-m ah'

[Pablo Neira Ayuso]

On Fri, Nov 25, 2016 at 05:32:39PM +0100, Phil Sutter wrote:
> This is actually a limitation of ip6tables:
> 
> | # ip6tables -A INPUT -p ah -j ACCEPT
> | Warning: never matched protocol: ah. use extension match instead.
> 
> The working alternative is like so:
> 
> | # ip6tables -A INPUT -m ah -j ACCEPT
> 
> But upon translating, this statement gets ignored:
> 
> | $ ip6tables-translate -A INPUT -m ah -j ACCEPT
> | nft add rule ip6 filter INPUT  counter accept
> 
> This patch (ab)uses the 'space' variable to check if a parameter to the
> 'ah' match was present and if not translates the match into an extension
> header check:
> 
> | $ ip6tables-translate -A INPUT -m ah -j ACCEPT
> | add rule ip6 filter INPUT meta l4proto ah counter accept

Applied, thanks Phil.