diff options
| author | Phil Sutter <phil@nwl.cc> | 2022-11-17 16:39:40 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2022-11-24 10:24:06 +0100 |
| commit | 0b946dabf34a068adf3e35924578ffb06a249bb8 (patch) | |
| tree | 197ccf9f5e85458410258747ff7c50978e41ea99 /extensions | |
| parent | 424ef98918d31377a305cdf1626e1c1f69ab6df1 (diff) | |
extensions: tcp: Translate TCP option match
A simple task since 'tcp option' expression exists.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions')
| -rw-r--r-- | extensions/libxt_tcp.c | 9 | ||||
| -rw-r--r-- | extensions/libxt_tcp.txlate | 6 |
2 files changed, 12 insertions, 3 deletions
diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c index 0b115cdd..043382d4 100644 --- a/extensions/libxt_tcp.c +++ b/extensions/libxt_tcp.c @@ -430,9 +430,12 @@ static int tcp_xlate(struct xt_xlate *xl, space = " "; } - /* XXX not yet implemented */ - if (tcpinfo->option || (tcpinfo->invflags & XT_TCP_INV_OPTION)) - return 0; + if (tcpinfo->option) { + xt_xlate_add(xl, "%stcp option %u %s", space, tcpinfo->option, + tcpinfo->invflags & XT_TCP_INV_OPTION ? + "missing" : "exists"); + space = " "; + } if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { xt_xlate_add(xl, "%stcp flags %s", space, diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate index 921d4af0..a1f0e909 100644 --- a/extensions/libxt_tcp.txlate +++ b/extensions/libxt_tcp.txlate @@ -24,3 +24,9 @@ nft add rule ip filter INPUT ip frag-off & 0x1fff != 0 ip protocol tcp counter iptables-translate -A INPUT ! -f -p tcp --dport 22 nft add rule ip filter INPUT ip frag-off & 0x1fff 0 tcp dport 22 counter + +iptables-translate -A INPUT -p tcp --tcp-option 23 +nft add rule ip filter INPUT tcp option 23 exists counter + +iptables-translate -A INPUT -p tcp ! --tcp-option 23 +nft add rule ip filter INPUT tcp option 23 missing counter |