Hi, On Sat, 16 Aug 2008, Changli Gao wrote: > When using iptables to extent the firewall of Linux, I found that: if > there are more than one kinds of iptables matches, only the former > options are parsed correctly, but the later options will be treated > wrongly. > > For example: > > iptables -t mangle -A PREROUTING -m a --mac-source 00:11:22:33:44:55 > -m b --mac-source 00:11:22:33:44:55 -j ACCEPT > > the above command will fail due to the later match. Yes: you should use match-specific options, like iptables -t mangle -A PREROUTING -m a --a-mac-source 00:11:22:33:44:55 -m b --b-mac-source 00:11:22:33:44:55 -j ACCEPT > Then I checked the source code of iptables. It seems that the extra > options for each match are global for each individual command. It is > out of my exception. I used to think that options are only available > for that match. So I "fixed" this issues quickly. After patching, the > command options contain the default global options and the last match > or the target extra options. With your patch applied we'd loose supporting multiple matches of the same type. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
