Changli Gao wrote: > When using iptables to extent the firewall of Linux, I found that: if > there are more than one kinds of iptables matches, only the former > options are parsed correctly, but the later options will be treated > wrongly. > > For example: > > iptables -t mangle -A PREROUTING -m a --mac-source 00:11:22:33:44:55 > -m b --mac-source 00:11:22:33:44:55 -j ACCEPT > > the above command will fail due to the later match. > > Then I checked the source code of iptables. It seems that the extra > options for each match are global for each individual command. It is > out of my exception. I used to think that options are only available > for that match. So I "fixed" this issues quickly. After patching, the > command options contain the default global options and the last match > or the target extra options. I see, it's worth to know this issue. However, my main objection with this patch is: is there any match in iptables mainline that actually uses two options with clashing names? -- "Los honestos son inadaptados sociales" -- Les Luthiers -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
