extensions: add xlate test for ipables -f

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate
index ccec4362916faa566876fad30ce2a616cb1912d5..bba63324df2b6fe89fb15fc6fa0d9ca2812cc907 100644 (file)
--- a/extensions/libxt_tcp.txlate
+++ b/extensions/libxt_tcp.txlate
@@ -18,3 +18,9 @@ nft add rule ip filter INPUT tcp flags & (fin|syn|rst|ack) == syn counter accept
 
 iptables-translate -A INPUT -p tcp --syn --dport 80 -j ACCEPT
 nft add rule ip filter INPUT tcp dport 80 tcp flags & (fin|syn|rst|ack) == syn counter accept
+
+iptables-translate -A INPUT -f -p tcp
+nft add rule ip filter INPUT ip frag-off & 0x1fff != 0 ip protocol tcp counter
+
+iptables-translate -A INPUT ! -f -p tcp --dport 22
+nft add rule ip filter INPUT ip frag-off & 0x1fff 0 tcp dport 22 counter