Pascal Hambourg írta:
The problem is that both connmark and mark have a --mark option...
I just wonder why a match looks for options beyond the next -m which
starts a new match.
Maybe I am wrong, but as I know the iptables GIVES the options to the
match...
So there is no command line parsing/looking for options by the match...
I think it is happens like this:
1. iptables checks the command line for matches and loads them,
2. every match registers its "extra_opts" in an internal table, (this
time connmark and mark registers the same "mark" option.)
3. iptables checks the remaining command line options against the table.
4. if the option found in the table then the match will decide the
option's fate (with the "parse" callback function).
The first registered match having "mark" option gets called every time a
"mark" found in the command line.
And because this option is not allowed twice the match gives an error
message.
Swifty
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
