On Tue, Nov 29, 2016 at 12:47:25PM +0100, Phil Sutter wrote: > This fixes TCP flags matches: > > | $ iptables-translate -A invalid -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP > | nft add rule ip filter invalid tcp flags & fin|syn == fin|syn counter drop > > Although the generated rule is syntactically correct and accepted by > nft, it will be interpreted in a different way than expected since > binary AND takes precedence over OR. And this one also applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
