On Sun, Sep 30, 2012 at 11:25:42PM +0200, Jan Engelhardt wrote: > > On Sunday 2012-09-30 23:09, Pablo Neira Ayuso wrote: > >On Sun, Sep 30, 2012 at 12:22:09PM +0200, Jan Engelhardt wrote: > >> Specifying -S on the command line would add 4096 (0x1000, 1<<12) to the > >> cmd flags, but -S was in fact commands_v_options[13]. This led to a > >> bogus option checking and an error message: > >> > >> $ iptables -A foo -S > >> iptables v1.4.14: Cannot use -E with -A > > > >Are you fixing old bugs? > >This works here: > ># iptables -A foo -S > >iptables v1.4.15: Cannot use -S with -A > > Hm. > > >http://git.netfilter.org/[...]h=067a9baf6dc82babe466078ab3c05354c7741271 > > You only changed the "cmdflags" variable so that it lines up with > the CMD_ flags, however, you forgot to line up "commands_v_options" > as well. > > Indeed your patch 067a9baf fixes "cannot use $that with $that". > My commit message was wrong, as I was misled by v1.4.14 behavior. > In fact, I had the real issue written down first. Approximate > excerpt from the reflog: > > > iptables: fix order of command flags for option parser > > Specifying -S on the command line would add 4096 (0x1000, 1<<12) to the > cmd flags, but -S was in fact commands_v_options[13]. > > This problem never manifested itself before, because the [8]-[13] mostly > had the same 'x' pattern. Now, when trying to allow --line-numbers for > -S, the issue showed itself as --line-numbers was still rejected even > after swapping 'x' for ' '. > > References: http://bugs.debian.org/642173 > > > Does that make more sense? Yes, that log description looks correct to me. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
