On Friday 2008-08-15 14:46, Pablo Neira Ayuso wrote: >Changli Gao wrote: >> When using iptables to extent the firewall of Linux, I found that: if >> there are more than one kinds of iptables matches, only the former >> options are parsed correctly, but the later options will be treated >> wrongly. >> >> For example: >> >> iptables -t mangle -A PREROUTING -m a --mac-source 00:11:22:33:44:55 >> -m b --mac-source 00:11:22:33:44:55 -j ACCEPT >> >> the above command will fail due to the later match. >> >> Then I checked the source code of iptables. It seems that the extra >> options for each match are global for each individual command. It is >> out of my exception. I used to think that options are only available >> for that match. So I "fixed" this issues quickly. After patching, the >> command options contain the default global options and the last match >> or the target extra options. > >I see, it's worth to know this issue. However, my main objection with >this patch is: is there any match in iptables mainline that actually >uses two options with clashing names? - mark, connmark, realm - ecn and ECN - multiport and tcp/udp/sctp/dccp. (There was a reason to my post after all ;-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
