Re: [PATCH nf-next] netfilter: exthdr: add support for tcp option removal

[Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>]

On Mon, Dec 20, 2021 at 03:32:47PM +0100, Florian Westphal wrote:
> This allows to replace a tcp option with nop padding to selectively disable
> a particular tcp option.
> 
> Optstrip mode is chosen when userspace passes the exthdr expression with
> neither a source nor a destination register attribute.
> 
> This is identical to xtables TCPOPTSTRIP extension.

Is it worth to retain the bitmap approach?

> Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
> ---
>  proposed userspace syntax is:
> 
>  nft add rule f in delete tcp option sack-perm

   nft add rule f in tcp option reset sack-perm,...