Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have 2 strings, and i wish to queue the packet if it contains both the strings ( something like ("jsh"&&"gjhyg")), i tried following ways, but they don't seem to work:

sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "abc" --algo bm -m string --string "def" --algo bm

This doesn't work, it only works if the packet contains the string "abcdef", but the packet i wish to queue contains the strings at two different locations. Then I tried another method:

sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "abc" --algo bm

sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "def" --algo bm

But this time it works like "or", it queues packets with string "abc" or "def".

share|improve this question
    
I would have expected the first solution to work, since multiple -m are normally combined with an AND... and I can't find any reference of using regexp in the pattern. I'd say you just can't do it :/ –  m4573r Oct 2 '12 at 8:04
    
I can do this, but only at application level. By analyzing the queued packets matching any one string, and then matching for second string in my netfilter_queue C module. This method is definitely slower. –  adnan kamili Oct 2 '12 at 10:06
add comment

1 Answer

the "and" in this case could be achived with an user defined chain

sudo iptables -N my_chain

sudo iptables -A my_chain -p tcp -j QUEUE ! -f -m string --string "def" --algo bm

sudo iptables -A INPUT -p tcp -j my_chain ! -f -m string --string "abc" --algo bm

when the input chain process the last line and "abc" is present the control jumps to my_chain which has a similar rule checking for the presence of "def"; if "def" is there then jumps to QUEUE.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.