diff options
| author | Phil Sutter <phil@nwl.cc> | 2022-11-17 16:39:40 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2022-11-24 10:24:06 +0100 |
| commit | 0b946dabf34a068adf3e35924578ffb06a249bb8 (patch) | |
| tree | 197ccf9f5e85458410258747ff7c50978e41ea99 /extensions/libxt_tcp.txlate | |
| parent | 424ef98918d31377a305cdf1626e1c1f69ab6df1 (diff) | |
extensions: tcp: Translate TCP option match
A simple task since 'tcp option' expression exists.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libxt_tcp.txlate')
| -rw-r--r-- | extensions/libxt_tcp.txlate | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate index 921d4af0..a1f0e909 100644 --- a/extensions/libxt_tcp.txlate +++ b/extensions/libxt_tcp.txlate @@ -24,3 +24,9 @@ nft add rule ip filter INPUT ip frag-off & 0x1fff != 0 ip protocol tcp counter iptables-translate -A INPUT ! -f -p tcp --dport 22 nft add rule ip filter INPUT ip frag-off & 0x1fff 0 tcp dport 22 counter + +iptables-translate -A INPUT -p tcp --tcp-option 23 +nft add rule ip filter INPUT tcp option 23 exists counter + +iptables-translate -A INPUT -p tcp ! --tcp-option 23 +nft add rule ip filter INPUT tcp option 23 missing counter |