extensions: libip6t_ah: Fix translation of plain '-m ah'

This is actually a limitation of ip6tables:

| # ip6tables -A INPUT -p ah -j ACCEPT
| Warning: never matched protocol: ah. use extension match instead.

The working alternative is like so:

| # ip6tables -A INPUT -m ah -j ACCEPT

But upon translating, this statement gets ignored:

| $ ip6tables-translate -A INPUT -m ah -j ACCEPT
| nft add rule ip6 filter INPUT  counter accept

This patch (ab)uses the 'space' variable to check if a parameter to the
'ah' match was present and if not translates the match into an extension
header check:

| $ ip6tables-translate -A INPUT -m ah -j ACCEPT
| add rule ip6 filter INPUT meta l4proto ah counter accept

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c
index 5c2fe558ec4648be501997a82adbfe4050a8ec24..f35982f379d763814ee2742f1065f45e268e2e1a 100644 (file)
--- a/extensions/libip6t_ah.c
+++ b/extensions/libip6t_ah.c
@@ -152,8 +152,13 @@ static int ah_xlate(struct xt_xlate *xl,
                space = " ";
        }
 
-       if (ahinfo->hdrres != 0)
+       if (ahinfo->hdrres != 0) {
                xt_xlate_add(xl, "%sah reserved %u", space, ahinfo->hdrres);
+               space = " ";
+       }
+
+       if (!space[0]) /* plain '-m ah' */
+               xt_xlate_add(xl, "meta l4proto ah");
 
        return 1;
 }