diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-04-19 11:56:15 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-05-02 23:30:35 +0200 |
| commit | 88993e0ce90f05a1b6e1b09a8dbbf41d6d4551b7 (patch) | |
| tree | 53c81710e64c14fbc7f2856d56257ecd0e38adf9 /tests/py/inet | |
| parent | 2ffb2f44dc541c2ec3265ec80bf6be805cafcf80 (diff) | |
parser_bison: missing relational operation on flag list
Complete e6c32b2fa0b8 ("src: add negation match on singleton bitmask
value") which was missing comma-separated list of flags.
This patch provides a shortcut for:
tcp flags and fin,rst == 0
which allows to check for the packet whose fin and rst bits are unset:
# nft add rule x y tcp flags not fin,rst counter
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/py/inet')
| -rw-r--r-- | tests/py/inet/tcp.t | 1 | ||||
| -rw-r--r-- | tests/py/inet/tcp.t.json | 19 | ||||
| -rw-r--r-- | tests/py/inet/tcp.t.payload | 7 |
3 files changed, 27 insertions, 0 deletions
diff --git a/tests/py/inet/tcp.t b/tests/py/inet/tcp.t index 29f06f5a..5f2caea9 100644 --- a/tests/py/inet/tcp.t +++ b/tests/py/inet/tcp.t @@ -81,6 +81,7 @@ tcp flags & (syn|fin) == (syn|fin);ok;tcp flags & (fin | syn) == fin | syn tcp flags & (fin | syn | rst | psh | ack | urg | ecn | cwr) == fin | syn | rst | psh | ack | urg | ecn | cwr;ok;tcp flags == 0xff tcp flags { syn, syn | ack };ok tcp flags & (fin | syn | rst | psh | ack | urg) == { fin, ack, psh | ack, fin | psh | ack };ok +tcp flags ! fin,rst;ok tcp window 22222;ok tcp window 22;ok diff --git a/tests/py/inet/tcp.t.json b/tests/py/inet/tcp.t.json index 70225182..922ab91c 100644 --- a/tests/py/inet/tcp.t.json +++ b/tests/py/inet/tcp.t.json @@ -1730,3 +1730,22 @@ } } ] + +# tcp flags ! fin,rst +[ + { + "match": { + "op": "!", + "left": { + "payload": { + "protocol": "tcp", + "field": "flags" + } + }, + "right": [ + "fin", + "rst" + ] + } + } +] diff --git a/tests/py/inet/tcp.t.payload b/tests/py/inet/tcp.t.payload index 5eaf4090..da932b6d 100644 --- a/tests/py/inet/tcp.t.payload +++ b/tests/py/inet/tcp.t.payload @@ -701,3 +701,10 @@ inet [ payload load 1b @ transport header + 13 => reg 1 ] [ lookup reg 1 set __set%d ] +# tcp flags ! fin,rst +inet + [ meta load l4proto => reg 1 ] + [ cmp eq reg 1 0x00000006 ] + [ payload load 1b @ transport header + 13 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x00000005 ) ^ 0x00000000 ] + [ cmp eq reg 1 0x00000000 ] |