I wrote:
The other definition which is tighter is:
Def2: If a packet is matched it traverses certain chains until a
terminal target is reached. Those chains form a path.
A loop exists if and only if there exists a packet whose path
through the chains contains some chain at least twice.
It must be stated that implementing a loop detection based on Def2
is not possible if general function based matches are used (like
netfilter does).
As we want nf-hipac to support function based matches we have in fact
no choice. Our loop detection will use Def1.
