Match multiple strings in iptables

Question

I have 2 strings, and i wish to queue the packet if it contains both the strings ( something like ("jsh"&&"gjhyg")), i tried following ways, but they don't seem to work:

sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "abc" --algo bm -m string --string "def" --algo bm

This doesn't work, it only works if the packet contains the string "abcdef", but the packet i wish to queue contains the strings at two different locations. Then I tried another method:

sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "abc" --algo bm

sudo iptables -A INPUT -p tcp -j QUEUE ! -f -m string --string "def" --algo bm

But this time it works like "or", it queues packets with string "abc" or "def".

Answer 1

the "and" in this case could be achived with an user defined chain

sudo iptables -N my_chain

sudo iptables -A my_chain -p tcp -j QUEUE ! -f -m string --string "def" --algo bm

sudo iptables -A INPUT -p tcp -j my_chain ! -f -m string --string "abc" --algo bm

when the input chain process the last line and "abc" is present the control jumps to my_chain which has a similar rule checking for the presence of "def"; if "def" is there then jumps to QUEUE.