Oops, forgot to say that missing logical operation is equivalent to and.
Note that we have to do _two_ calls of ss to do this. State match is always anded to address/port match. The reason for this is purely technical: ss does fast skip of not matching states before parsing addresses and I consider the ability to skip fastly gobs of time-wait and syn-recv sockets as more important than logical generality.
Pardon, this does not work with current kernel, patching is required. But we still can look at server side: