From 88993e0ce90f05a1b6e1b09a8dbbf41d6d4551b7 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 19 Apr 2021 11:56:15 +0200
Subject: parser_bison: missing relational operation on flag list

Complete e6c32b2fa0b8 ("src: add negation match on singleton bitmask
value") which was missing comma-separated list of flags.

This patch provides a shortcut for:

    tcp flags and fin,rst == 0

which allows to check for the packet whose fin and rst bits are unset:

    # nft add rule x y tcp flags not fin,rst counter

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 tests/py/inet/tcp.t.json | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

(limited to 'tests/py/inet/tcp.t.json')

diff --git a/tests/py/inet/tcp.t.json b/tests/py/inet/tcp.t.json
index 70225182..922ab91c 100644
--- a/tests/py/inet/tcp.t.json
+++ b/tests/py/inet/tcp.t.json
@@ -1730,3 +1730,22 @@
         }
     }
 ]
+
+# tcp flags ! fin,rst
+[
+    {
+        "match": {
+            "op": "!",
+            "left": {
+                "payload": {
+                    "protocol": "tcp",
+                    "field": "flags"
+                }
+            },
+            "right": [
+                "fin",
+                "rst"
+            ]
+        }
+    }
+]
-- 
cgit v1.2.3